Your health information, and how we look after it.

Ballarat Doctors (“the practice”, “we”, “us”) holds personal and health information about our patients, their carers, people who contact us and visitors to this website. This policy explains what we collect, why, where it is kept, who sees it, and how you can look at it or have it corrected.

We are bound by the Privacy Act 1988 (Cth) and its thirteen Australian Privacy Principles, and — because we provide health services in Victoria — by the Health Records Act 2001 (Vic) and its eleven Health Privacy Principles. Where the two differ, we apply whichever gives you greater protection.

When you register, you consent to our doctors, nurses and administrative staff collecting and using your information to provide health care. Only staff who need your record to do their job can open it, and access is logged.

If we ever want to use your information for something not directly related to your care, we ask first. You can withdraw or narrow that consent at any time by telling reception or your GP, and it will not affect the care you receive.

A small number of situations allow or require disclosure without consent — they are listed under Who we share it with.

Identifying and administrative: name, date of birth, gender and pronouns if you tell us, address, phone, email, emergency contact and next of kin, Medicare number, DVA or concession card, Individual Healthcare Identifier, private health cover where relevant, billing records, and your appointment history including cancellations and non-attendance.

Health information: medical, family and social history, the reason for each visit and the clinical notes, examination findings, diagnoses, care plans and reviews, medicines and prescriptions, allergies and adverse reactions, pathology and imaging results, immunisation history, and correspondence with specialists, hospitals and allied health providers.

Other: enquiries you send us, feedback and complaints, and anything needed to meet a legal or reporting obligation.

Personal information is anything from which you can reasonably be identified. Sensitive information is a subset that attracts stronger protection — and all health information is sensitive information. So are details of racial or ethnic origin, religious beliefs, sexual orientation and criminal record where those are relevant to your care.

Throughout this policy, “your information” means both.

Wherever it is reasonable and practicable we collect information directly from you — on the registration form, in a consultation, over the phone, or through online booking.

Where that is not practicable we may collect it from your parent, guardian, carer or authorised representative; from other services involved in your care, including specialists, hospitals, Australian Clinical Labs and imaging providers; from your previous practice when you ask for a transfer; from Medicare, the Department of Veterans’ Affairs or the Australian Immunisation Register; or from your My Health Record where you have one and have not restricted access.

You do not have to give us what we ask for. If you decline, we may not be able to provide the service, and your GP may be working from an incomplete picture — they will tell you if that is the case.

Clinical photographs, ECG traces, spirometry results and similar records form part of your health record, are stored in the same secure system, and are used for your diagnosis and ongoing care.

We do not use identifiable patient photographs, clinical images or before-and-after imagery in any advertising. We also do not publish patient testimonials or reviews about clinical care, and we do not ask patients for them. Section 133 of the Health Practitioner Regulation National Law, as it applies in Victoria, prohibits testimonials in advertising a regulated health service, and prohibits advertising that is false or misleading, creates an unreasonable expectation of benefit, or encourages unnecessary use of health services. That applies whether or not a patient consents.

If we ever wanted to use a de-identified image for teaching or quality improvement, we would seek your specific written consent, and you are free to say no.

We collect, hold and use your information to assess, diagnose and treat you; to keep an accurate record; to coordinate your care with other services; to manage appointments, recalls and reminders; to issue prescriptions, referrals, requests and certificates; to bill and claim Medicare benefits; to meet legal, regulatory and accreditation obligations; to handle enquiries and complaints; and to review and improve the quality and safety of our care, using de-identified information wherever possible.

We collect only what is reasonably necessary for those purposes.

Where a consultation happens by phone or video, what is discussed goes into your record in exactly the same way as an in-person visit and is protected in the same way.

We take reasonable steps to conduct telehealth securely and privately, and we do not record the audio or video of a consultation. We cannot control the privacy of the space you are calling from, so choose somewhere you can speak freely.

Your record is held electronically in a clinical information system. Paper correspondence is scanned in and then securely destroyed.

Our measures include individual logins with access limited by role; automatic screen locking; encrypted, regularly tested backups held securely off site; firewalls, antivirus and applied security updates; secure messaging with other providers; physical security of the premises and secure destruction of paper; confidentiality agreements signed by every staff member and contractor; and privacy and information-security training with a documented business continuity plan.

Please keep your contact details current with reception. Out-of-date details are one of the most common reasons a result or a recall fails to reach the person it was meant for.

The Health Records Act 2001 (Vic) sets minimum retention periods. If you were an adult at your last visit, we keep your record for at least seven years from the last occasion we provided you with a health service. If you were under 18, we keep it until you turn 25.

Once information is no longer needed and the retention period has passed, it is destroyed or de-identified securely. If your records are transferred to another practice at your request, we keep a note of where and when they were sent.

We share only what is necessary, and only with those who need it:

• Other services involved in your care — specialists, hospitals, allied health, Australian Clinical Labs, imaging providers, and after-hours or locum services
• Medicare, the Department of Veterans’ Affairs or your health fund, for claiming
• The Australian Immunisation Register, for immunisations we give
• Your nominated carer, guardian or authorised representative, with your consent or where the law allows
• Contracted providers who support the practice — clinical software, IT support, secure backup and hosting, our booking provider and our accountant — all bound by confidentiality obligations and the Australian Privacy Principles
• Where required or authorised by law, such as a subpoena or search warrant
• Where a condition must be notified under the Public Health and Wellbeing Act 2008 (Vic), or a mandatory report must be made to Child Protection under the Children, Youth and Families Act 2005 (Vic)
• Where necessary to lessen or prevent a serious threat to life, health or safety, and it is not practicable to get consent first

Other than as described above we do not share your information without consent. We do not sell, rent or trade personal information, and we do not disclose it for anyone else’s marketing.

If you have a My Health Record, your GP may upload a shared health summary or event summary and may view what is already there as part of your care. You control the record — you can set access controls, remove documents or cancel it entirely through myGov, or by calling 1800 723 471.

We also use Individual Healthcare Identifiers, assigned under the Healthcare Identifiers Act 2010 (Cth), to make sure the right record is matched to the right person.

When you visit this site we may collect technical information such as your IP address, browser and device type, the pages viewed and the time of the visit. It is used to keep the site working, to understand what people are looking for, and to protect the site from misuse.

Online bookings are handled by HotDoc under its own terms and privacy policy, with the details coming through to our clinical system. Enquiries you send by email or form are used to respond to you, and recorded in your health record if they relate to your care.

Email is not secure. Please do not send clinical details, results or anything sensitive by email — ring reception instead.

With your consent we may contact you by SMS, email, phone or post about appointment reminders and confirmations; results that need discussing; recalls for preventive health, screening, immunisation or a care plan review; and practice information such as a change to our hours.

You can opt out at any time by telling reception or replying to an SMS as directed. If you do, we will still contact you about something clinically important, and you may stop receiving screening and immunisation reminders that would otherwise have been sent.

We do not use your health information to send you advertising, and we do not give your details to anyone else for marketing.

You have the right to ask for access to the information we hold about you, and to ask us to correct anything inaccurate, out of date, incomplete or misleading.

Put your request in writing to the Practice Manager, by post to T5, 21-53 Learmonth Road, Wendouree VIC 3355, or by email to info@ballaratdoctors.com.au. We will ask for proof of identity before releasing anything.

We respond within 45 days, as required by the Health Records Act 2001 (Vic). A reasonable administrative fee may apply for copies, and we will tell you what it is before doing the work. There is no fee for making a request or asking for a correction.

Access may be refused in limited circumstances — for example where it would pose a serious threat to someone’s life or health, or unreasonably affect another person’s privacy. If that happens we tell you in writing, give reasons, and explain how to have the decision reviewed. If we do not agree a correction is warranted, you may ask us to attach a statement of your view to the record, and we will.

If you are concerned about how we have handled your information, please tell us first — most concerns are sorted out quickly. Put it in writing to the Practice Manager. We will acknowledge it, investigate and respond within 45 days.

If you are not satisfied, or would rather go elsewhere:

• Health Complaints Commissioner (Victoria) — handles complaints under the Health Records Act 2001 (Vic). Phone 1300 582 113 or visit hcc.vic.gov.au
• Office of the Australian Information Commissioner — complaints under the Privacy Act 1988 (Cth). Phone 1300 363 992 or visit oaic.gov.au
• AHPRA — concerns about a practitioner’s conduct or performance. Phone 1300 419 495 or visit ahpra.gov.au

These bodies will usually expect you to have raised the matter with us first and given us a reasonable chance to respond.

If information we hold is lost, or accessed or disclosed without authorisation, we act immediately to contain the incident and assess what has happened.

Where a breach is likely to result in serious harm, we notify the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. We will tell you what happened, what information was involved, and what you can do about it.

We do not routinely disclose personal information to recipients overseas. Some software and cloud services we rely on may store or process data on servers outside Australia; where that is the case we take reasonable steps to satisfy ourselves the provider handles it consistently with the Australian Privacy Principles.

If your care required us to send information to a provider overseas — for example if you are moving abroad and want your records transferred — we would ask for your consent first.

We review this policy regularly and may update it to reflect changes in the law, in technology or in how the practice operates. The current version is always the one published here, and the version number and review date appear at the top of the page.