Cabrini Health - Privacy Policy

Cabrini is committed to the protection of personal privacy of its patients, residents, staff and other customers. The following policy is based on the Health Privacy Principles (HPPs) as detailed in the Health Records Act 2001, (VIC) and the National Privacy Principles (NPPs) as detailed in The Privacy (Private Sector Amendment) Act 2000, (Cth). The policy deals with the collection, use and disclosure of personal and health information as well as access and correction, data security and data retention.

1. Collection

1.1 Cabrini will only collect health and personal information that is necessary in
providing quality care and managing the Organization.

1.2 Information will only be collected by lawful and fair means and not in an
unreasonably intrusive way.

1.3 Patients, residents and other individuals will, at or before the time of collecting the
information be informed of :

the purpose for which the information is being collected,
the fact that he or she is able to gain access to the information,
to whom the organization usually discloses information of that kind,
any law that requires the particular information to be collected and
the main consequences (if any) for the individual if all or part of the information is
not provided.

1.4 Where possible, Cabrini will only collect information from the subject of the
information.

2. Use & Disclosure

Cabrini will only use and disclose information for a secondary purpose if:

the secondary purpose is directly related to the primary purpose and the individual
would reasonably expect the organization to use or disclose the information for the secondary purpose
the patient, resident or other individual has consented to the use or disclosure
the use or disclosure is required, authorised or permitted, whether expressly or
impliedly by or under law, and
in those other situations described in HPP2 and NPP2

3. Data Quality

Cabrini will take reasonable steps to ensure that the personal and health information it
collects, uses or discloses is accurate, complete and up to date and relevant to its functions
or activities.

4. Data Security and data Retention

4.1 Cabrini will take reasonable steps to protect the health and personal information it
holds from misuse and loss and from unauthorised access, modification or
disclosure.

4.2 Cabrini will take reasonable steps to destroy or permanently de identify personal or
health information if it is no longer needed for any purpose.

5. Openness

5.1 Cabrini will have clearly expressed policies and procedures on its management of
personal and health information including steps that an individual must take in order
to obtain access to their information.

5.2 Cabrini will, on request from an individual, advise whether it holds information
relating to them and how they can gain access.

6. Access and Correction

6.1 Where Cabrini holds information about an individual, it will provide the individual
with access to the information on request, in a form or manner suitable to the
individual’s reasonable needs except in those situations stipulated in HPP6.1 and
NPP6.1.

6.2 Cabrini may charge for providing access to information, however the charges will
not be excessive and will not apply to lodging a request for access.

6.3 If an individual is able to establish that the information that Cabrini holds is
inaccurate, incomplete, misleading or not up to date, Cabrini will take reasonable
steps to correct the information. Information will not be deleted otherwise than in
accordance with HPP 4.2.

6.4 Cabrini will provide reasons for denial of access or correction.

7. Identifiers

7.1 Cabrini will not adopt as its own identifier an identifier that has been assigned by a
government agency.

7.2 Cabrini will not use or disclose an identifier assigned to an individual by a
government agency except in those situation described in HPP 7.3 and 7.4

8. Anonymity

Whenever it is lawful and practicable, individuals will have the option of not identifying
themselves when dealing with Cabrini.

9. Transborder Data Flows

Cabrini will not transfer personal or health information about an individual unless the
individual has consented or the transfer is authorised or required by any other law.

10. Making Information Available to Another Health Service Provider

On the request of the individual Cabrini will make health information available to another
health service provider. In an emergency situation Cabrini will release health information
to other hospitals or medical practitioners.
The Manager, Health Information Services is the Cabrini Health Privacy Officer
A copy of the Health Privacy Principles (HPPs) and the National Privacy Principles
(NPPs) are available from Hospital Projects (Ext 1863), or the Medical Records