Your privacy

Morisset Doctors (the practice, we, us or our) is committed to protecting the privacy, confidentiality and security of personal information about our patients, their carers, visitors to the clinic and users of this website.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles and, as a health service in New South Wales, by the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles. Where the two differ, we apply whichever gives you greater protection.

We also follow the privacy requirements of the RACGP Standards for general practices and the confidentiality duties that apply to all registered health practitioners. This policy applies to everyone who works at or for the practice, including doctors, nurses, reception and administration staff, contractors, students on placement and our IT providers.

When you register as a patient, you consent to our doctors and staff accessing and using your personal health information to provide your care. Only team members who need your record to do their job can access it.

This covers the everyday running of a general practice: appointments, history taking, tests, referrals, prescriptions, Medicare billing and recalls when a result needs follow-up.

When we ask again

• Releasing your record to an insurer, employer, solicitor or other third party
• Preparing a report for legal, insurance or employment purposes
• Sending your information to a doctor who is not involved in your care
• Using a clinical photograph for teaching or quality improvement
• Providing de-identified data for research or quality improvement

Withdrawing consent

You can withdraw consent at any time by telling any member of our team. This does not affect anything already lawfully done, or records we must keep by law. If withdrawing would affect your care, a doctor will explain how first.

Children and young people. A parent or guardian usually consents for a child. As young people mature, a doctor will assess whether they can consent for themselves, and from then on their consultations are treated confidentially, subject to the safety exceptions below.

Your health record is the complete clinical and legal file the practice holds about you. It allows any doctor here to care for you safely when your usual doctor is away. It usually includes:

• Your contact and demographic details
• Consultation notes, including the reason for your visit, findings and plan
• Medical and family history, allergies and adverse reactions
• Current and past medicines and prescriptions
• Immunisation history
• Pathology and imaging results, and specialist and hospital letters
• Referrals, care plans, health assessments and certificates
• Records of phone calls, telehealth, recalls and reminders
• Billing and Medicare claims

The record belongs to the practice; the information in it is about you, and you have a right to access it.

Personal information is information or an opinion that identifies you, or could reasonably identify you, such as your name, date of birth, address, phone, email, Medicare, DVA and concession card details, emergency contact and billing history. A combination of details that could reveal who you are is also treated as personal information.

Sensitive information, which includes health information, carries a higher risk of harm and has extra protection. We only collect it with your consent and where necessary for our work, and only use or disclose it for the purpose collected or a directly related purpose you would expect, unless the law requires or permits otherwise.

What we collect

• Identity and contact details, next of kin, emergency contact and any nominated representative
• Aboriginal or Torres Strait Islander status, only if you choose to tell us, so we can offer the assessments and programs you are eligible for
• Preferred language and interpreter needs
• Medicare, DVA, concession and private health fund details, and payment records
• Symptoms, history, examination findings, diagnoses, medicines, allergies, immunisations, results and correspondence
• Appointment history, messages, feedback and complaints

How we collect it

Wherever practical, we collect information directly from you: when you register, book in person, by phone on (02) 4006 8222 or online, attend a consultation or telehealth appointment, or contact us. Sometimes we collect it from others, such as referring doctors, pathology and imaging providers, specialists and hospitals, My Health Record, the Australian Immunisation Register, Medicare or DVA, or a carer or guardian, when this is necessary for your care.

A doctor may photograph a skin lesion, wound or rash to monitor it. We explain why and ask for consent first. Images are taken on practice equipment and saved directly to your record, not kept on personal devices or sent by ordinary text or email. If a specialist needs to see an image, it is sent by secure clinical messaging.

We never use clinical photographs for teaching, publication or promotion without your separate, recorded consent. Please ask before recording audio or video during a consultation.

You do not have to give us any particular information, but without it a doctor may not be able to reach a diagnosis, prescribe safely, bulk bill you, contact you about results, or write referrals and reports that others will accept. Your doctor will tell you if missing information is limiting your care.

You can ask general questions without giving your name, but consultations need your identity so we can keep accurate records, prescribe safely and claim Medicare. If you have a particular concern about being identified, please speak with our Practice Manager on (02) 4006 8222.

• To assess, diagnose, treat and monitor your health
• To keep an accurate clinical record
• To communicate with other practitioners involved in your care
• To send results, recalls and reminders
• To prescribe safely
• To claim Medicare and DVA benefits and manage accounts
• To meet legal obligations, including notifiable disease reporting
• For quality improvement and clinical audit, using de-identified data where possible
• To train doctors, nurses and students, with your consent
• To manage feedback, complaints and legal claims

We do not sell your information, use it for third-party marketing, or share it with advertisers or data brokers.

Telehealth consultations are recorded in your notes in the same way as face-to-face visits. Your doctor will confirm your identity, the call is not recorded by the practice, video uses a clinical platform with encrypted connections, and prescriptions and referrals are sent electronically.

We cannot control the privacy of where you are or your device and network. If you can be overheard, tell your doctor and they can call back or ask you to come in.

• Individual logins with role-based access, removed when someone leaves
• Audit logs showing who accessed which record and when
• Encryption in transit and regular, tested backups
• Current software, security updates and anti-malware protection
• Auto-locking screens positioned away from public view
• Secure messaging for clinical information, not ordinary email
• Confidentiality agreements for all staff, contractors and IT providers
• Paper records kept in secure areas and destroyed securely

Email is not secure. We will not send your health information by unencrypted email unless you ask us to and understand the risk. Please do not email us clinical details or images; call (02) 4006 8222 instead.

Under NSW law we keep adult records for at least seven years after the last entry, and records of people who were under 18 at the last entry until they turn 25. We may keep records longer where they are relevant to a legal matter or your ongoing care. When the retention period ends, records are destroyed securely or de-identified.

If you move practices, we send a copy or summary to your new doctor at your request and keep the original.

For your care

• Specialists and doctors we refer you to
• Pathology and imaging providers, including 4Cyte Pathology
• Hospitals, after-hours services and community health services treating you
• Allied health practitioners and pharmacists in your care team
• Your nominated carer, guardian or representative
• My Health Record, unless you have opted out or restricted access

To run the practice

• Our clinical software and IT providers, under confidentiality obligations
• Medicare, DVA and health funds for claiming
• Accountants, auditors and insurers on a limited, confidential basis
• Debt recovery for unpaid accounts, limited to necessary details and never clinical information

Where the law requires or permits

• Notifiable disease reporting to NSW Health
• The Australian Immunisation Register and statutory registers such as cancer registries
• Mandatory reporting where a child or young person is at risk of significant harm
• Subpoenas, court orders, warrants or other legal requirements
• To lessen or prevent a serious threat to someone's life, health or safety

We release only what is necessary, note it in your record and tell you unless the law prevents us.

We do not discuss your care with family members without your consent, including partners, parents of adult children or adult children of older parents. Tell us if you would like someone to be able to speak with us on your behalf and we will record it.

My Health Record is a national online summary of your key health information. If you have one and have not restricted access, our doctors may view it and upload summaries after consultations. Through myGov you can set access codes, hide or remove documents, view an access log or cancel your record. Tell us if you prefer we do not upload information, and we will note it.

We use your Individual Healthcare Identifier, a 16-digit number, to match electronic health information to the right person. It is used only for identification and communication and protected like the rest of your record.

You can read this website without telling us who you are. We do not run advertising trackers or sell visitor data. The site collects standard technical information with each request, aggregate analytics to improve the site, and anything you choose to submit in a form. A small number of cookies keep the site working and measure overall use; you can block them in your browser.

Online bookings are provided by HotDoc, a third-party platform, under its own privacy policy and terms; details you enter are then transferred to our clinical system. You can always book by calling (02) 4006 8222 instead. We are not responsible for the privacy practices of other websites we link to.

Social media. Please do not send clinical details, symptoms or images through social media.

With your consent, we may contact you about results that need discussing, tests, reviews or vaccinations that are due, appointment confirmations and changes to our services. Messages are brief and never include clinical details. We contact you by SMS, phone, letter or email based on your recorded preference, and you can change it or opt out by calling (02) 4006 8222. Opting out does not affect your care, but means we will not prompt you when something is due. We do not send commercial marketing.

Please make your request in writing to the Privacy Officer, or ask reception for a form. We will confirm your identity and respond within 30 days, usually with a copy or a doctor-prepared summary, and a doctor may offer to go through it with you. There is no charge to make a request; a reasonable fee may apply for copying a large record, and we will tell you first.

Access may be refused in limited cases, such as a serious threat to someone's safety, an unreasonable impact on another person's privacy, or legal proceedings. We will explain any refusal in writing.

Please tell us when your contact or Medicare details change. If you believe clinical information is inaccurate, ask us to correct it. If a doctor does not agree, we will add a statement of your view to your record.

Write to: Privacy Officer, Morisset Doctors, Shop 5, 35 Yambo Street, Morisset NSW 2264, or call (02) 4006 8222.

Please raise any concern with our Practice Manager, Robyn, in person, by calling (02) 4006 8222, or in writing to the Privacy Officer. We will acknowledge your complaint within seven days and respond in writing within 30 days, or tell you if we need longer. Making a complaint will not affect your care.

• Office of the Australian Information Commissioner: 1300 363 992, oaic.gov.au
• Information and Privacy Commission NSW: 1800 472 679, ipc.nsw.gov.au
• Health Care Complaints Commission: 1800 043 159, hccc.nsw.gov.au

A data breach is when personal information is lost, or accessed or disclosed without authorisation. We have a written response plan: we contain the breach, assess what was involved and the possible harm, act to reduce harm and prevent recurrence, and notify affected people and the regulator where required. Under the Notifiable Data Breaches scheme, where a breach is likely to cause serious harm, we notify you and the Office of the Australian Information Commissioner as soon as practicable.

We strongly prefer clinical records to stay in Australia. Some services, such as email filtering, backup, software support and appointment reminders, may store or access limited data overseas. Where this happens, we take reasonable steps to make sure the provider handles information consistently with the Australian Privacy Principles, under written agreements. We do not otherwise send your health information overseas without consent, unless the law requires it.

We review this policy regularly and update it when our practices, providers or the law change. The current version and review date are shown on this page, and significant changes are noted at reception and on the website. A printed copy is available at reception, including in large print or explained through an interpreter.

• Phone: (02) 4006 8222
• Email: info@morissetdoctors.com.au
• Post: Privacy Officer, Morisset Doctors, Shop 5, 35 Yambo Street, Morisset NSW 2264
• In person: ask at reception to speak with Robyn, our Practice Manager

In an emergency, call 000. Do not use email, this website or social media for urgent medical problems. For advice at any hour, call Healthdirect on 1800 022 222.