Privacy Policy – Tedder Avenue Medical Practice Privacy Policy
1. Policy
The Privacy Act 1988 and the Australian Privacy Principles require our practice to have a document that clearly sets out its policies on handling personal information, including health information.
This document, called a Privacy Policy, outlines how we handle personal information collected (including health information) and how we protect this information.
Our practice has used the privacy policy template available from the RACGP and this has been adapted to reflect how our practice collects and uses personal information.
Our privacy policy is available on request from the reception and the same is mentioned in the practice information sheet and practice website.
Our collection of information statement informs patients about how their personal health information will be used, including by other organisations to which the practice usually discloses patient information, and any law that requires the particular information to be collected. Patient consent to the handling and sharing of personal patient health information is sought and documented early in the process of clinical care, and patients are made aware of the collection statement when giving consent to share health information.
According to the Privacy Act 1988 and the Australian Privacy Principles, an organisation may use or disclose personal health information for a purpose (the secondary purpose) which is directly related to the primary purpose of collection without seeking consent, but only if the individual would have a reasonable expectation that the information could be used or disclosed for that secondary purpose.
A directly related secondary purpose for the use and disclosure of personal health information in our practice includes the many activities necessary for the provision of a health service, such as management, funding and monitoring, as well as complaint-handling, planning, evaluation and accreditation activities.
It is essential to recognise the importance of ‘reasonable expectation’ as many individuals may be unaware of the range of activities for which their personal health information may be used and disclosed, such as the accreditation processes. Our practice ensures we tell patients how, and for what purpose, personal health information collected about them could be used or disclosed. Patients are advised of this ‘secondary purpose’ in a number of ways, including:
• At the time of the consultation with a general practitioner
• Via the practice privacy statement in the practice information sheet
• By reading, understanding and signing a new patient information form when first registering at the practice, which incorporates the practice privacy statement.
It is important we maintain a patient’s right to ‘opt out’ of the secondary purpose through refusal to consent. If an individual expresses negative views or opposition when made aware of a proposed secondary use or disclosure of their personal health information, this would indicate that they have a reasonable expectation that their personal health information will not be used or disclosed in that manner, and their non-consent is recorded on file.
2. Procedure
We inform our patients about our practice’s policies regarding the collection and management of their personal health information via:
• Our practice information sheet
• New patient information forms
• Verbal means if appropriate, and
• Our practice website.
3. Managing Patient Health Information
Purpose
To ensure patients who receive care from the practice are comfortable in entrusting their health information to the practice. This policy provides information to patients as to how their personal information is collected and used within the practice and the circumstances in which we may disclose it to third parties.
Scope
This policy applies to all employees and patients of Tedder Avenue Medical Practice.
4. Practice Procedure
The Practice will:
• Provide a copy of this policy upon request.
• Ensure staff comply with the privacy policy and deal appropriately with all enquiries or concerns.
• Take such steps as are reasonable in the circumstances to implement practices, procedures and systems to ensure compliance with the APP and deal with inquiries or complaints.
• Collect personal information for the primary purpose of managing a patient’s healthcare and for financial claims and payments.
5. Staff Responsibility
The practice staff will take reasonable steps to ensure patients understand:
• What information has been and is being collected.
• Why the information is being collected and whether this is due to a legal requirement.
• How the information will be used or disclosed.
• Why and when their consent is necessary.
• The Practice’s procedures for access and correction of information, and responding to complaints of information breaches, including by providing this policy.
All staff members are required to comply with confidentiality agreements and receive ongoing privacy training, including correct use of secure systems, document automation, and RACGP guidelines. Staff involved in referral generation or AI scribe tools receive specific training to ensure privacy and security.
6. Patient Consent
The practice will only interpret and apply a patient’s consent for the primary purpose for which it was provided. The Practice staff must seek additional consent from the patient if the personal information collected may be used for any other purpose.
7. Patient Health Record Definition
A Patient Health Record (PHR) is a comprehensive and confidential electronic or paper-based compilation of a patient’s medical information, including but not limited to:
• Contact and demographic information
• Emergency contact and next of kin details
• Ethnicity (where collected for health or reporting purposes)
• Medical history, clinical assessments, diagnostic tests, treatment plans, prescriptions, immunisation history
• Observations, correspondence, specialist letters
• Photographs, diagnostic images, or audio recordings (where relevant and with consent)
• Prescription records and medication charts
• Insurance and health fund details
• Legal information and reports
• Work health and safety reports
8. Collection, Use and Disclosure
The practice may collect information:
• Via new patient registration forms (paper or electronic)
• Through consultation with healthcare providers at the practice
• From guardians or responsible persons where appropriate
• From other healthcare providers such as hospitals, specialists, allied health, community health, pathology, or imaging services
• Through secure online channels such as My Health Record, Australian Immunisation Register, National Cancer Screening Register, or via electronic prescribing
• From website, email, SMS, telephone, online booking systems, or social media enquiries
Images and recordings:
• Clinical photos (only with patient consent, following RACGP guidelines on personal device use)
• Diagnostic images such as x-rays, CT scans, ultrasounds
• CCTV footage from the shopping centre precinct for safety and security
• Real-time audio/visual recording of a consultation (including telehealth) must never occur without patient’s express consent.
• Where consultations are transcribed using AI scribe software, the practice obtains and documents the patient’s informed consent prior to activation of the software. Patients are informed of:
• The purpose of the recording (clinical documentation support)
• What information will be captured
• How the audio data is processed, stored and deleted
• That the GP reviews and verifies all content before it becomes part of the health record
• Their right to decline or withdraw consent at any time without impact on their care
Personal information may be used or disclosed for:
• Healthcare provision and referrals
• Billing and Medicare/DVA/health fund claiming
• Accreditation and quality improvement activities
• Research and teaching, where only de-identified data is shared (patients may opt out)
• Medical defence purposes
• Serious threat to life, health or safety
• Mandatory disease notifications
• Legal obligations such as subpoenas
• Locating a missing person
• Confidential dispute resolution processes
The practice will not disclose personal information to third parties outside Australia unless legally required or with patient consent.
9. Marketing
The practice does not use patient information for marketing purposes without express consent. Patients may opt out of direct marketing at any time.
10. Document Automation Technologies
The practice uses document automation technologies in compliance with RACGP guidelines to streamline referrals and clinical documents. These include:
• Ensuring only relevant medical information is included
• Secure electronic transmission of referral letters
• Staff training in correct use of systems and data accuracy
• Restricting access to authorised personnel only
11. Artificial Intelligence (AI) Scribes
The practice uses an AI transcription tool to assist GPs in drafting consultation notes.
• Informed verbal consent is obtained at the start of each consultation where AI scribe software is used. This consent is documented in the patient health record. If consent is declined, the AI scribe function is not activated.
• Audio is destroyed once transcription is complete
• Transcriptions are not stored outside Australia
• Doctors review and approve all notes before they enter the patient record
• Patients may request not to have an AI scribe used during their consultation
12. Data Quality
Patient information collected and retained in our records will be complete, accurate, and up to date at the time of collection. Doctors are reminded to review past medical history regularly.
13. Data Security
Patient information may be held in paper, electronic, image, or audio form. Security measures include:
• Confidentiality agreements for staff and contractors
• Secure premises and locked storage for physical records
• Password-protected systems with access levels
• 24/7 monitoring of digital security measures
Retention of medical records:
• Adults: minimum 7 years after last entry
• Children: until the patient is 25 years old
14. Access to Patient Information and Correction
• Patients have the right to request access to their records in writing.
• Preferred process: review with GP during a consultation (non-rebateable).
• Requests will be responded to within 28 days.
• Correction requests are welcomed and patients may be asked to verify details.
• Information can be transferred securely to another health provider upon request.
15. Parents / Guardians and Children
To protect a child’s privacy, access to medical information may be restricted for parents/guardians if the child is over 15 years of age. Final decision rests with the treating doctor.
16. Complaints
The practice takes privacy complaints seriously. Patients may raise concerns with the Practice Manager in writing.
If unresolved, complaints can be directed to:
• Office of the Australian Information Commissioner (OAIC)
📞 1300 363 992 | 🌐 www.oaic.gov.au
• Office of the Health Ombudsman (QLD)
📞 133 OHO (133 646) | 🌐 www.oho.qld.gov.au | ✉️ info@oho.qld.gov.au
17. Website and Cookies
Any information shared with the practice via website, email, or social media is handled securely. Our website may use analytics and cookies to improve service delivery.
18. Review Date
Reviewed 14.04.2026
To be reviewed annually, or earlier if required by legislation or practice changes.