Outcome Health Clinical Services Privacy Policy

Purpose and Scope

Outcome Health is committed to protecting the privacy and confidentiality of personal and health information handled in the delivery of its clinical services.

This policy sets out how Outcome Health protects patient privacy when providing clinical services, including how personal and health information is collected, used, disclosed, accessed, stored and protected in the course of clinical care delivery.

It applies to Outcome Health employees, contractors, clinicians and other authorised personnel involved in the delivery, coordination or governance of clinical services.

This policy complements Outcome Health’s organisational Privacy Policy and relevant clinical governance, information security, records management and incident management requirements. Program-specific privacy arrangements may be documented separately where required.

Privacy and Confidentiality Principles

Outcome Health manages clinical information in accordance with applicable privacy and health information legislation, professional obligations, contractual requirements and clinical governance standards.

Outcome Health clinicians will maintain patient confidentiality in all aspects of clinical care and professional interactions, consistent with applicable professional codes of conduct, ethical obligations and clinical governance requirements. Patient information will only be accessed, discussed, used or disclosed where appropriate for the clinician’s professional duties, with patient consent where required, or where otherwise permitted or required by law.

Outcome Health will:

collect only information reasonably necessary to provide, coordinate or administer clinical services;
inform patients about how their information will be handled;
respect patient consent, confidentiality and information-sharing preferences;
use and share information only for authorised purposes and on a minimum-necessary basis;
restrict access to authorised personnel;
protect information through appropriate security safeguards; and
retain and dispose of information in accordance with applicable requirements.

Clinical information will not be used or disclosed for purposes unrelated to the patient’s care or authorised program activities unless consent has been provided or the use or disclosure is otherwise permitted or required by law.

Collection and Use of Patient Information

Outcome Health collects information reasonably necessary to provide safe and effective clinical services. This may include:

identifying, contact and referral information;
relevant medical, surgical and mental health history;
medications and treatment information;
clinical and risk assessments;
care plans and clinical notes;
information about other health and support services involved in the patient’s care; and
appointment and service-delivery information.

Where practicable, information is collected directly from the patient. Information may also be received from referral or commissioning organisations, healthcare providers, carers or other authorised parties involved in the patient’s care.

Outcome Health may use patient information for clinical assessment and care, care planning and coordination, risk management, communication with the patient and care team, clinical governance, service administration, quality assurance and authorised program reporting or evaluation.

Consent and Information Sharing

Patients will be provided with appropriate information about why their information is collected, how it will be used, who it may be shared with and how they may access or correct their information or raise a privacy concern.

Consent for the collection, use and disclosure of patient information will be obtained and documented where required.

Patients may withdraw or limit consent, subject to applicable legal and clinical requirements. Where this may affect Outcome Health’s ability to safely or effectively provide or coordinate care, the implications will be discussed with the patient and documented.

Where practicable, patients may choose to interact with Outcome Health anonymously or using a pseudonym, unless Outcome Health is required or authorised by law to deal with an identified individual. Where anonymity or use of a pseudonym may limit Outcome Health’s ability to safely or effectively provide clinical services, those limitations will be explained to the patient.

Outcome Health may share relevant information with program partners, commissioning organisations, GPs, treating clinicians and other health or support providers where necessary for an authorised purpose and supported by consent or another lawful basis.

Only information reasonably necessary for the relevant purpose will be shared. Participation in a funded, commissioned or coordinated care arrangement does not provide another organisation with unrestricted access to a patient’s clinical record.

Information may be disclosed without consent where required by law. Any such disclosure will be limited to information reasonably necessary in the circumstances and appropriately documented.

Storage, Access and Security

Clinical information, whether held electronically or in physical form, will be stored only within Outcome Health-approved systems or other approved secure environments.

Access is restricted to personnel who require the information for an authorised clinical, administrative or governance purpose and is managed according to role and need.

Outcome Health applies appropriate safeguards including:

secure physical storage and restricted access for paper-based clinical records;
individual authentication and access controls;
secure systems, devices and communication mechanisms;
system logging and monitoring where applicable;
physical security where required;
backup and recovery arrangements; and
workforce confidentiality and information security requirements.

Clinical information must not be stored or transmitted using personal accounts, personal devices or unapproved systems or communication channels.

Privacy Incidents and Data Breaches

Actual or suspected unauthorised access, disclosure, loss, alteration or misuse of patient information must be promptly reported through Outcome Health’s incident management processes.

Data breaches will be managed in accordance with Outcome Health’s Data Breach Response Plan and applicable legal, contractual and regulatory requirements. This includes containment, assessment, escalation, investigation, notification where required, remediation and corrective action.

Where an incident involves a program partner, Outcome Health will notify and cooperate with the relevant organisation in accordance with applicable arrangements.

Outcome Health will assess whether an incident triggers notification requirements under the Notifiable Data Breaches scheme or other applicable requirements.

Records Retention and Disposal

Clinical records will be retained in accordance with applicable legal, professional, contractual and Outcome Health records management requirements. Program-specific retention requirements will be documented separately where applicable.

Records must not be destroyed while subject to an active legal, regulatory, clinical, complaint, audit or investigation requirement.

At the end of the applicable retention period, records will be securely destroyed or permanently de-identified where appropriate.

Patient Access, Correction and Complaints

Patients may request access to personal and health information held about them and request correction of information that is inaccurate, incomplete or out of date.

Requests will be managed in accordance with applicable privacy and health records requirements and relevant clinical considerations.

Patients may also raise questions or concerns about the handling of their information or make a privacy complaint through Outcome Health’s established privacy processes.

Privacy enquiries and complaints can be directed to Outcome Health’s Privacy Officer:
Email: privacyofficer@outcomehealth.org.au
Phone: (03) 8822 8444

Outcome Health will respond to privacy enquiries and complaints within 30 days. If you are not satisfied with our response, or have not received a response within 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Program-Specific Privacy Arrangements

Where clinical services involve other organisations, the respective roles and privacy responsibilities will be defined through relevant contractual or program governance arrangements.

Program-specific arrangements will address, as applicable:

organisations involved and their respective roles;
information collected and exchanged;
patient consent and information-sharing arrangements;
systems and approved communication mechanisms;
access and security controls;
privacy incident notification responsibilities;
retention and disposal requirements; and
program reporting requirements.

Outcome Health will review privacy arrangements where there is a material change to the service, participating organisations, information flows, consent arrangements or systems.

Responsibilities

All Outcome Health personnel involved in clinical service delivery are responsible for maintaining patient privacy and confidentiality in their professional interactions and in their handling of patient information, accessing information only as required for their authorised duties, using approved systems and promptly reporting suspected privacy or security incidents.

Clinical leads and relevant governance personnel are responsible for ensuring clinical privacy requirements, consent arrangements and information-sharing practices are appropriate to the service.

Program managers are responsible for ensuring approved privacy arrangements are implemented within their programs.

Review

This policy will be reviewed annually or following material changes to applicable requirements, Outcome Health’s clinical service model, information systems or information-sharing arrangements.

Risk Assessment

This Policy is assessed for risk of content variation according to the matrix below:

Low Risk Reviewed every 2 years
Medium Risk Reviewed every year
High Risk Reviewed every 6 months
Extreme Risk Reviewed every 3 months or less

Outcome Health Clinical Services Privacy Policy