Dealing with Personal Information

If we hold Personal Information about an individual, they have a right to access that information, correct that information and request the destruction of that information. Should you receive any of the above-mentioned requests from an individual, you must comply with that request after consulting the Practice Manager.

Personal Information which is collected by us should only be used for:

• the primary purpose; or

• a purpose related to the primary purpose and which the individual would reasonably expect the Personal Information to be used for.

This will differ depending on each stakeholder (e.g. patient versus job seeker) and their needs. Where we require Personal Information about an individual, when requesting such information from an individual, it must be made clear at the outset why the information is required, and how it will be used.

If the information is disclosed to us by an individual without requesting it, we must ensure the information is actually required in order to complete the services we have been engaged for.

If it is not required, we should destroy the information.

Where Personal Information is held by us, we must ensure the information is stored securely and accurately. Accordingly, information should only be stored on company approved systems and should be saved to the appropriate location in accordance with company policy. Equally important is securing and protecting devices e.g. mobile phones and laptops in order to prevent unauthorised access or loss.

Additionally, access to information is only permitted if it is a genuine requirement of your role and duties.

It is the responsibility of all stakeholders to ensure the information is kept up-to-date and accurate. Should you become aware of outdated information, you must update it.

Where Personal Information is held by us and it is no longer required for the purpose it was collected for, you should contact the Practice Manager who will arrange to either securely destroy such information, or de-identify the information.

The requirements of the Privacy Laws continue to apply when employees work off site or from home. When working remotely and dealing with privacy and/or personal information, employees and contractors must:

• ensure they only work in private spaces (including video conferences and phone calls);

• where possible, use headphones during work related calls to minimise the information that may be inadvertently overheard;

• ensure that their work-related devices are locked and secured when not in use, in accordance with our policies and procedures; and

• documents containing personal information should not be printed out in hard copy.

• Contact the Practice Manager

• Refer to our Data Breach Response Plan