Privacy Policy

Policy

Our practice recognises that email is a convenient method of communication; however, it also carries risks to patient privacy and confidentiality.

Email communication with patients will be conducted with appropriate regard to privacy, confidentiality and information security, and in accordance with the practice’s Privacy Policy.

The practice will obtain and document a patient’s consent before sending health information to them electronically. Where a patient initiates email communication with the practice, consent to communicate by that method may be implied for the purposes of responding appropriately to that communication.

Patients will be informed of the risks associated with email communication, including that information may be intercepted, forwarded, accessed or read by someone other than the intended recipient.

Email must not be used for emergencies or matters requiring urgent medical attention.

Procedure

Communication with patients

The practice uses email primarily for general, administrative and non-urgent communication.

Patients who communicate with the practice by email are advised that:

• email is not monitored continuously and must not be used for emergencies or urgent medical matters;

• the practice aims to respond to emails within 2-3 business days;

• email should not be relied upon for time-critical clinical communication;

• there are inherent privacy and security risks associated with email;

• some information cannot appropriately or securely be provided by ordinary email; and

• an alternative method of communication may be required depending on the nature or sensitivity of the information.

Where urgent medical attention is required, patients should telephone the practice, contact an appropriate emergency service or call Triple Zero (000) in an emergency.

An automatic response is generated when an email is received by the practice to reinforce these requirements and advise patients of the risks and limitations associated with email communication.

Patient consent

Before health information is sent to a patient by email, the practice will obtain and document the patient’s consent to electronic communication.

Patients will be provided with appropriate information about the risks associated with electronic communication through the practice’s Privacy Policy, patient information material and/or other appropriate communication.

Where a patient initiates email communication with the practice, consent to respond by email may be implied. The nature and sensitivity of the information will still be considered before health information is sent electronically.

Patients may withdraw their consent to email communication at any time.

Information that may be communicated by email

Email may be used for general and non-urgent matters such as:

• practice information and administrative correspondence;

• appointment-related communication;

• forms and other general documents; or

• other information considered appropriate for electronic communication.

Clinical or sensitive health information, including medical records, investigation results, referrals and other confidential documents, will only be sent electronically where the practice is satisfied that it is clinically appropriate, the patient’s consent has been established and appropriate security measures are in place.

Where ordinary email is not considered sufficiently secure or appropriate, the practice will use an approved secure method of communication or arrange for the information to be provided by another means.

The practice will not use email to provide urgent clinical advice or manage medical emergencies.

Verification before sending

Before sending patient or health information electronically, practice team members must take reasonable steps to ensure:

• the patient’s identity has been appropriately established;

• the recipient’s email address is correct and current;

• the information relates to the correct patient;

• the information and attachments are accurate and intended for that recipient; and

• the communication method is appropriate to the sensitivity of the information.

Email addresses and other contact details should be confirmed with patients and updated in the patient record where required.

Particular care must be taken when using autofill or selecting recipients from an email address book.

Recording communications

An email sent or received in the course of a team member’s duties is a business communication and may constitute an official practice or clinical record.

All clinically relevant electronic communication with, from or about a patient, together with any action taken in response, must be recorded in or added to the patient’s health record.

Where electronic advice or information may incur a fee, the patient will be informed of the applicable cost before the service is provided.

Privacy and security

All practice team members are responsible for protecting patient privacy and confidentiality when using email.

Patient and other confidential information must only be sent using communication methods and security measures approved by the practice.

Practice team members must:

• use practice-authorised email accounts and systems for practice communication

• maintain appropriate professional language in all communications

• carefully check recipients before sending confidential information

• avoid opening unexpected or suspicious attachments or links

• follow practice procedures relating to phishing, malware and other cyber security threats

• not forward patient information to personal email accounts or unauthorised systems

• maintain the confidentiality of patient and practice information at all times.

Practice team members are informed of the practice’s email, privacy and information security requirements during induction and receive ongoing training and reminders as appropriate.

Communication with healthcare providers and other organisations

Where patient health information is communicated electronically to another healthcare provider or organisation, the practice will use an approved secure communication method wherever appropriate.

Before information is disclosed, team members must ensure that the disclosure is authorised, the intended recipient is correctly identified and only information appropriate to the purpose of the communication is provided.

Misdirected emails and privacy breaches

Any email containing patient or confidential information that is sent to an incorrect recipient, accessed by an unauthorised person, lost, compromised or otherwise involved in a suspected privacy or security breach must be reported immediately to the Practice Manager or other designated person.

The incident will be managed in accordance with the practice’s Privacy Policy, Data Breach Response Plan and applicable obligations under the Privacy Act 1988 and Notifiable Data Breaches scheme.

Team members must not attempt to conceal or independently resolve a suspected privacy breach without notifying the appropriate person within the practice.

Staff use of email

Practice email facilities are provided primarily for legitimate practice purposes.

Practice team members are expected to use email responsibly and must:

• limit personal use of practice email

• not respond to unsolicited, suspicious or unwanted emails

• delete hoax or chain emails

• not open unexpected attachments from unknown or suspicious senders

• follow the practice’s cyber security procedures for attachments and links

• maintain appropriate and professional language

• clearly identify personal opinions where relevant

• protect confidential information from unauthorised access or disclosure.

The practice reserves the right to monitor or review practice email systems where reasonably required for security, fraud prevention, regulatory compliance, investigation of workplace conduct or protection of confidential information, subject to applicable workplace and privacy requirements.

Inappropriate use of practice email systems may be investigated and managed in accordance with the practice’s employment and workplace policies.

Email Disclaimer

Outgoing emails affiliated with the practice include the following disclaimer:

IMPORTANT: This email and any attachments are intended only for the person or organisation to whom they are addressed and may contain confidential, privileged or sensitive information. If you are not the intended recipient, you must not use, copy, disclose or distribute this information. If you have received this email in error, please notify the sender by return email and permanently delete the email and any attachments.

Email communication may not be secure. If you are a patient, please do not use email for emergencies or matters requiring urgent medical attention. In an emergency, call Triple Zero (000).