Introduction
This policy explains how SA Homecare Therapies (SAHCT) collects, uses, holds and shares personal information, including health information, and what rights you have over it. SAHCT is a mobile allied health practice: our physiotherapists, occupational therapists, podiatrists and dietitians visit people where they live, across metropolitan Adelaide, the Fleurieu and the Adelaide Hills. As a health service provider, the Privacy Act and the Australian Privacy Principles apply to SAHCT regardless of our size.
References
- Privacy Act 1988 (Cth)
- Australian Privacy Principles
- Guardianship and Administration Act 1993 (SA)
- Advance Care Directives Act 2013 (SA)
- Consent to Medical Treatment and Palliative Care Act 1995 (SA)
Who does this policy cover?
This policy covers the personal information SAHCT holds about:
- our clients, and the family members or representatives who act for them
- the care partners, coordinators and doctors who refer clients to us
- people who visit our website
- people who apply to work with us
How do we come to hold your personal information?
There are three ways you might become a client of SAHCT, and they work differently:
- Through your care provider. Most of our clients are referred by an aged care or home care provider who arranges and funds their services. That provider registers you, decides which services you need, and sends us a referral. We receive your details from them before we meet you.
- Through your doctor. If your services are funded through the Department of Veterans’ Affairs or a Medicare care plan, your GP refers you to us and we receive your details from that referral.
- Directly. If you arrange and pay for your own services, you contact us yourself and give us your details directly.
When a referral reaches us we send you a text message to let you know, and we give you a copy of our information sheet at the first visit.
Why and when is your consent necessary?
We collect and use your personal information so that we can provide your care. Only the people who need to see your information are able to do so. If we need to use your information for anything else, we will seek your consent first.
SAHCT checks a client’s capacity to give informed consent before providing services. Where a client is not able to give informed consent, we work with the person legally able to decide for them — their guardian, their attorney under an enduring power of attorney, or their substitute decision-maker under an advance care directive, in accordance with References C, D and E.
Being unable to give informed consent is not a barrier to receiving SAHCT services.
Why does SAHCT collect, use, hold and share your personal information?
We use your personal information to assess you, to plan and deliver your care, to work with the other people involved in your care, to arrange payment for your services, and to meet our obligations under law and under our agreements with care providers.
We do not use your personal information for direct marketing. We sometimes send practical updates to the care partners and doctors who refer to us, such as an updated referral form, but these are not promotional.
What personal information do we collect?
The information we collect about you includes:
- your name, date of birth, address and contact details
- your medical history, medications, the reason you were referred to us, and details of the other health and wellbeing services involved in your care
- notes about your care, written by the therapist who visits you
- your social circumstances where they affect your care, such as who lives with you, who helps you, and how you manage at home
- your Medicare, Department of Veterans’ Affairs, National Disability Insurance Scheme or My Aged Care number, and your health fund details where they apply
- Your Medicare, Department of Veterans’ Affairs, National Disability Insurance Scheme and My Aged Care numbers are used only for the purpose they were issued — claiming for your services and confirming your eligibility with the body that issued them. We do not use them to identify you in our own records.
We do not store credit card details. Card details you give us over the phone are entered directly into our payment providers, Tyro and Medipass. We do not keep a copy.
Where your services are claimed through a health fund, Medicare, the Department of Veterans’ Affairs or the National Disability Insurance Scheme, the claim is lodged through Medipass, which receives your name, your membership or scheme number, and details of the service provided.
How do we collect your personal information?
We collect your personal information from you at your appointments, and also from other people where it is not practical or reasonable to collect it from you directly. This includes the care provider or doctor who referred you, a family member who contacted us on your behalf, your guardian or representative, your health fund, and government agencies.
Referrals reach us through our online referral form, by email from care providers and doctors, and sometimes from family members directly.
Do we take photographs?
Sometimes we take photographs as part of your care, such as a wound, a foot, a piece of equipment, or part of your home where we are assessing access or safety. We will usually ask your permission before taking one.
Photographs are taken within Nookal, our practice management system, and go straight into your record. They are not stored on the therapist’s phone. We treat them the same way as the rest of your health information and keep them for as long as we keep your records.
Can you deal with us anonymously?
You can make a general enquiry without telling us who you are, such as asking what we do, what areas we cover, or how our services work.
We cannot provide a service anonymously. We need to know who you are to deliver care safely, to claim for your services, and to keep the clinical records the law requires us to keep.
Who do we share your personal information with?
We share your personal information with the person or organisation who referred you:
- where an aged care or home care provider arranges and funds your services, we give that provider reports about your care and the clinical notes our therapists write, as part of the arrangement under which your services are provided
- where your doctor referred you under a Department of Veterans’ Affairs or Medicare arrangement, we report back to your doctor, and information about your services is provided to the Department of Veterans’ Affairs or Services Australia so that your services can be claimed
- where you arranged your services yourself, we do not report to anyone unless you ask us to
- We also share your personal information:
- with other health professionals involved in your care, where it is necessary and you have agreed
- with our suppliers — our practice management system, our information technology provider and our payment providers — who may only use your information to provide that service to us
- with accreditation and audit bodies, and where a claim or a dispute needs to be resolved
- where the law requires or permits it, including where there is a serious threat to a person’s life, health or safety
Only the people who need to see your information are able to do so. Other than the situations above, SAHCT will not share your personal information with any third party without your consent.
Do we send your personal information overseas?
We store your personal information in Australia. Nookal holds Australian client information on servers in Australia, and our business systems store information in Australia.
Some of our suppliers are global companies whose technical support staff may access their systems from outside Australia under contractual protections. We do not otherwise disclose your personal information overseas.
Do we use automated decision-making?
We do not use computer programs to make decisions about your care, or to do anything that substantially contributes to those decisions. Every decision about your care is made by a person.
How do we store and protect your personal information?
Your clinical records are held in Nookal, our practice management system, which stores Australian client information on secure servers in Australia and encrypts it both in storage and in transit.
We protect your personal information through a combination of technical and organisational measures. These include multi-factor authentication, managed passphrases, automatic security updates across our devices, restricted access to system activity logs, and rules governing how our team uses devices and networks.
Your personal information is not stored on personal devices or in personal email accounts.
Our team may only open a client’s record where they have a work reason to do so. System activity, including who has viewed a record, is logged and may be reviewed. Access is removed when a person stops working with us.
Paper records are kept to a minimum. Where a physical document is created it is stored securely, scanned into Nookal, and then shredded.
All SAHCT workers must read and acknowledge our IT and Cyber Security Policy, and complete privacy training when they join us and every year after that.
How long do we keep your personal information?
We keep your clinical records for at least seven years from the last service we provided to you. We may keep them longer where there is a reason to do so, such as where a claim or an inquiry is possible, or where our agreement with your care provider requires it.
If a client dies, we keep their records. A request for the records of someone who has died is considered case by case, and would normally be answered to the executor or legal personal representative of their estate on production of probate or letters of administration. We provide records to a Coroner where required.
How can you access and correct your personal information?
You have the right to access and correct your personal information. You can ask us for a copy of what we hold about you by emailing hello@sahomecaretherapies.com.au, phoning (08) 7078 1844, or writing to 324 Glen Osmond Road, Myrtle Bank SA 5064. We will respond within 30 days. We do not charge you for this.
Before we release anything we need to be confident we are giving it to the right person, so we will ask you to confirm your identity.
Someone else can ask on your behalf if you have given them written permission, or if they are your guardian, your attorney under an enduring power of attorney, or your substitute decision-maker under an advance care directive. We will ask to see the relevant document.
There are limited situations where we cannot give you everything we hold, such as where releasing it would pose a serious threat to a person’s life, health or safety, where it would unreasonably affect another person’s privacy, or where legal proceedings are underway. If we cannot give you something we will tell you why, and how to complain about that decision.
If something we hold about you is wrong, out of date, incomplete or misleading, tell us and we will correct it. If we do not agree that it is wrong, you can ask us to attach a statement of your view to the record, and we will. From time to time we will also ask you to check that what we hold about you is still correct and up to date.
Clinical notes are a record of what a therapist observed at the time, so we do not remove or rewrite them. We can add a correction or your statement alongside the original.
Where another organisation asks us for information about you, such as a new care provider, we will ask for your consent before we share it, unless the law requires or permits us to share it without asking.
What happens if there is a data breach?
SAHCT has a data breach response plan. If we become aware that your personal information may have been lost, or accessed or disclosed without authorisation, we assess it quickly and take steps to contain it.
Where a breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. We also notify your care provider where our agreement with them requires it.
How can you lodge a privacy related complaint, and how will the complaint be handled?
If you are unhappy with how we have handled your personal information, tell us. Phone (08) 7078 1844, email hello@sahomecaretherapies.com.au, or write to 324 Glen Osmond Road, Myrtle Bank SA 5064. You do not need to put your complaint in writing — a phone call is fine.
A Director will look into it. We will acknowledge your complaint within five business days and give you an answer within 30 days. If we need longer we will tell you why, and when you can expect a response.
If your services are arranged through a care provider, you are welcome to raise your complaint with them instead.
If you are not satisfied with our response, or you have not heard from us within 30 days, you can complain to the Office of the Australian Information Commissioner:
- oaic.gov.au
- 1300 363 992
- GPO Box 5288, Sydney NSW 2001
What if you apply to work with us?
We advertise our roles through Seek, and applications reach us there. Seek collects your information under its own privacy policy and stores and processes information both in Australia and overseas. See seek.com.au for details of how Seek handles your information.
Once we receive your application we download it to our own systems to review it. We keep applications from people we do not appoint for twelve months, because we sometimes go back to previous applicants when a role opens up. After that we delete them. Printed copies are stored securely and shredded.
Privacy and our website
You can browse sahomecaretherapies.com.au without telling us who you are. We do not use analytics or tracking software on our website, and you cannot register your own details there.
Our referral form is on the website. It is completed by care providers, doctors and family members referring someone to us, and it collects the details of the person being referred as well as the contact details of the person making the referral. The form is provided by Snapforms, which stores all information in Australia. Completed referrals go into Nookal.
When you email us at hello@sahomecaretherapies.com.au, we store your email address, the date and time of your message, and its contents.
Policy review statement
This policy, and the effectiveness of the controls behind it, will be reviewed annually.
