Privacy Policy

This Privacy Statement applies to our handling of personal information. ‘Personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether the information is recorded in a material form or not.

Personal information includes ‘sensitive information’, which is a particular type of personal information. Sensitive information includes identifying health information about you (such as details of your health and medical history or the health services you have received). Sensitive information also includes a person’s: religious beliefs; sexual preferences; political views; racial or ethnic origin; membership of a professional or trade association; and criminal record.

The information you provide us forms the basis of your health record. Your health record is updated when you see us.

When you register as a client of cohealth, you provide consent for the healthcare providers and authorised cohealth staff to access and use your personal information to facilitate the delivery of healthcare. Access to your personal information is restricted to healthcare providers who require it for your care. If we ever use your personal information for purposes other than outlined in this document, we will obtain additional consent from you.

It is important to us that as our client, you understand why we collect and use your personal information.

By acknowledging this Privacy Policy you consent to us collecting, holding, using, retaining and disclosing your personal information in the manners described below.

We collect your information to:

• provide our services
• fulfil our care and legal obligations, as a health service provider, to clients, their carers, guardians, and family members, and enable the ongoing support and care
• perform our business functions as an employer
• communicate with you and respond to your feedback, queries and requests for assistance
• undertake research, policy discussion and development, including as authorised by the applicable Commonwealth, Victorian, and Tasmanian laws
• personalise and improve your experience with cohealth services
• manage and conduct our business including administration, funding, planning and quality improvement, as well as ensuring a safe and secure environment for our clients, staff, and contractors
• recruit and employ staff, contractors and students undertaking placements
• support the management of the risk of family violence as contemplated by the Family Violence Information Sharing Scheme
• for a quality and safety purpose
• otherwise meet the purposes for which we collected the information

We collect information from:

• you directly or your dealings with us
• family members, guardians, carers and your nominated support person
• Appointments booking application (HotDoc), if you choose to register with HotDoc to book appointments
• your health care and other service providers
• past service providers
• your nominated employment referees
• government agencies, including but not limited to: the Department of Health, the Department of Families Fairness and Housing, NDIS, and Victoria Police
• our contracted service providers
• other information sharing entities under the Family Violence Information Sharing Scheme and Child Information Sharing Scheme

The types of personal and health information we usually collect include:

• Your name, contact details (including phone number, postal and email address), date of birth, gender, preferred pronouns, Medicare number, DVA number, other government identifiers, and your billing details if applicable
• Information about the healthcare services that we provide to you
• Information about the services that has been provided to you by another service
• Sensitive information about clients and employees
• Family violence related information and information provided by victims
• Information about your personal circumstances
• Records of our communications with you, including any complaints, requests or queries you make
• The content of any electronic forms you submit via our website
• Information gathered in feedback that you provide or surveys you complete
• Photographs of our clients and employees
• Audio and visual recordings during consultations. We will ask for your consent before recording you. your consent will be documented in your health record.
• Information required to manage our employment relationship with employees, including bank account details, tax file numbers, superannuation details, visa details, qualifications and employment history
• Information about your visits to our website
• Images via closed circuit television (CCTV) to observe non-private activity only

You can deal with us anonymously or under a pseudonym unless it is impracticable for us to do so or unless we are required or authorised by law to only deal with identified individuals.

If you are a cohealth client, we generally use your personal information for the following main purposes:

• to provide health services and other services for you;
• to provide you with information regarding our health services and other services;
• for administrative services, including billing and appointments, and for administration of our clinical records and management systems including accreditation;
• to refer you to other health professionals or support services; and
• to identify and claim benefits from third parties such as Medicare.

If you are a job applicant, staff member, student, volunteer or contractor/consultant service provider, we may use your personal information to manage our relationship with you or work or transact with you, for example to assess and (if successful) to engage an applicant, staff member or contractor.

Other specific purposes for which cohealth uses job applicants, staff members and contractor’s personal information include:

• for insurance purposes;
• to consider for the role being applied for; and
• to satisfy cohealth’s legal obligations.

Where cohealth receives unsolicited job applications, they will usually be dealt with in accordance with the unsolicited personal information requirements of the Privacy Act.

cohealth career website is managed by Talent Propeller. Refer to our website for Talent Propellers privacy policy –  https://cohealthcareers.org.au/policy/privacy/index/

We may also use your personal information for purposes permitted under the applicable privacy laws, which may include the following:

• for purposes which are directly related to the main purposes we use your information (as above) – in circumstances where you would reasonably expect us to use your information;
• for management, planning, monitoring, improvement and evaluation of our services, we take all reasonable steps to de-identify any information used. You may be approached or invited to participate in specific surveys for research and program improvement or evaluation purposes, and your consent will be obtained for this purpose; and
• for training and educating our own staff, we take all reasonable steps to
  de-identify any information used.

cohealth is committed to LGBTIQA+ health equity. With client’s consent, cohealth asks and collects information about LGBTIQA+ identity. This ensure people have an opportunity to affirm their identity, and that cohealth provide the best service possible.

Referrals

Some of your personal information may be used for your referrals. cohealth uses a clinical software that ensures only relevant information is included on referrals.

Marketing

cohealth will not use your personal information for marketing any goods or services directly to you without your express consent. If you do consent, you may opt out of direct marketing at any time by notifying cohealth in writing.

cohealth may use your personal information to improve the quality of the services offered to clients through research, analysis of client data for quality improvement and for training activities with the cohealth team
We may provide de-identified data to other organisations to improve population health outcomes. If we provide this information to other organisations clients cannot be identified from the information we share, the information is secure and is stored within Australia. You can let reception staff know if you do not want your de-identified information included.

At times, cohealth is approached by research teams to recruit eligible clients into specific studies which require access to identifiable information. You may be approached by a member of cohealth team to participate in research.

Researchers will not approach you directly without your express consent having been provided to cohealth. If you provide consent, you would then receive specific information on the research project and how your personal health information will be used, at which point you can decide whether to participate or not participate in the research project.

We will not use or disclose your information for any purpose other than the purpose for which it was collected, or for a related (or, in the case of health and sensitive information, directly related) purpose that you would reasonably expect, or we are permitted or required to do so by law. For example, cohealth may disclose your information:

• to other health professionals or support services involved in the provision of your care
• to hospitals, clinics, pathology and diagnostic service providers, and other organisations involved in the provision of your care
• to outsourced service providers where necessary to enable cohealth to perform its function as a healthcare service
• if we reasonably consider the disclosure is necessary to lessen a serious threat to you or others
• to information sharing entities in the circumstances permitted under the Family Violence Information Sharing Scheme and Child Information Sharing Scheme
• to government agencies, such as Medicare, so you can claim benefits for services
• to funding bodies, such as where you receive services which those bodies have funded
• to My Health Record, if you have not opted out for this Australian Government service
• to Commonwealth agencies and departments, such as the Australian Taxation Office and Centrelink
• to Australian superannuation funds
• to family members, carers, guardians and your nominated support person
• for research, which will help us provide better care and services. Research undertaken at cohealth is required to meet ethical standards set by the Human Ethics Advisory Group, which include procedures and guidelines to de-identify health information and protect your privacy. De-identification involves removing all identifying data items for example, name and address
• to state and Commonwealth databases, such as Specialist Homelessness Information Platform (SHIP), HotDoc appointment booking platform, and state-wide mental health database CMI/ODS

cohealth will only transfer your information outside Victoria or Tasmania to a recipient authorised to receive it in accordance with our privacy obligations, if you have consented to the transfer, or where we reasonably believe that the recipient of your information is subject to a law or contractual arrangement which provides for the handling of your information in a manner consistent with the principles set out in the Privacy Act 1988, Health Records Act 2001 (Vic), and Personal Information Protection Act 2004 (Tas).

We may collect your personal information through the cohealth website, such as your email address or other contact details when you seek information regarding our services or make another enquiry with us. We will deal with this personal information in accordance with this Privacy Statement and the privacy laws.

We use ‘cookies’ on our websites to make web pages easier to use. A cookie is a small packet of information that a website places on a computer as a tool to record preferences and enhance functionality of the site. We may also use web beacons, Flash local stored objects and JavaScript. When you use our website, having your cookies enabled will allow us to maintain the continuity of your browsing session and remember your details when you return.

You can prevent the use of these through adjusting your browser settings to block, reject or delete these functions, but this may affect your ability to use the full functionality of the website and it may not function in an optimal manner.

We may also use analytics tools to collect data about your interaction with our websites, and to track use of our websites and to maintain and improve those sites.

Information collected could include:

• IP address
• top-level domain name
• the date and time of visit to cohealth website
• pages accessed on the cohealth website and any documents downloaded
• type of browser used, such as Internet Explorer, Firefox, Safari, or Google Chrome
• type of device used, such as phone, tablet, or PC

cohealth’s staff are required to respect the confidentiality of personal information and the privacy of individuals.

cohealth has in place steps to protect the personal information cohealth holds from misuse, interference and loss, and from unauthorised access, modification, and disclosure. We use various physical and technological security measures to protect the personal information we hold, including locked storage of paper records and passworded access rights to computerised records.

We store your information securely and where possible, we keep it in an electronic file.

We have a data breach response plan, which we would follow in the unlikely event of a privacy or data breach. We are also required to comply with the mandatory ‘notifiable data breach’ scheme (the NDB scheme) under the Privacy Act. The NDB scheme applies when an ‘eligible data breach’ of personal information occurs.

An ‘eligible data breach’ occurs when:

• there is unauthorised access to or unauthorised disclosure of personal information, or a loss of personal information, that an organisation holds
• this is likely to result in serious harm to one or more individuals
• the organisation has not been able to prevent the likely risk of serious harm with remedial action

An organisation may take remedial steps to prevent the likelihood of serious harm occurring for any affected individuals after a data breach has occurred, in which case, the data breach is not an ‘eligible data breach’.

Where we have reasonable grounds to believe that we have experienced an eligible data breach, and remedial action cannot be used, we will promptly notify affected individuals and the Office of the Australian Information Commissioner about the breach in accordance with the Privacy Act.

When your personal information is no longer required, and in the case of your health information, the information has been retained for the required periods under the HPPs or otherwise under law, we will take steps to securely destroy the information or to ensure that the information is permanently de-identified. Note that under law we are generally required to hold your health information for a minimum of seven years from the date of last entry for an adult, and for any clients who are children until they would have reached 25 years old.

cohealth will take reasonable steps to ensure that the personal information it holds is accurate, complete, up-to-date, relevant and not misleading.

Document automation is where systems use existing data to generate electronic documents relating to medical conditions and healthcare.

cohealth uses document automation technologies to create documents such as referrals, which are sent to other healthcare providers. These documents contain only your relevant health information.

These document automation technologies are used through secure electronic health records (EHR) systems, Best Practice and TrakCare.

All users of the EHR systems have their own unique user credentials and password and can only access information that is relevant to their role.

cohealth complies with the Australian privacy legislation and APPs to protect your information.

All data, both electronic and paper are stored and managed in accordance with the Royal Australian College of General Practitioners Privacy and managing health information guidance.

cohealth uses an AI scribe tool to support healthcare providers to take notes during their consultations with you. The AI scribe uses an audio recording of your consultation to generate a clinical note for your health record. We will ask for your consent before using AI scribe. Your consent will be documented in your health record. cohealth’s AI scribe service is Heidi.

Heidi:

• does not share information outside of Australia
• destroys the audio file once the transcription is complete
• removes sensitive, personally identifying information as part of the transcription

cohealth will only use data from our digital scribe service to provide healthcare to you.

You have a right to request access to the personal information that we hold about you.

To request access to medical records or other health information, you will need to complete a Health Records Access Application form. The form is also available from reception at any cohealth service. You are required to provide proof of your identity to staff when applying. We may charge a fee, as allowed under legislation, for photocopying and sending the information. If fees apply, you will be contacted to discuss those fees prior to release.

You may otherwise request access to the personal information that we hold about you, using our contact details below:

• Email: privacy@cohealth.org.au
• Call: 03 9448 6266
• Postal: 90 Maribyrnong St, Footscray VIC 3011

In certain circumstances, we may refuse to allow you access to your personal information where this is authorised by the law, such as where providing access would have an unreasonable impact on the privacy of other individuals, providing access would pose a serious threat to the life or health of any person or to public health or safety, or giving access would be unlawful.

If you believe that the personal information we hold about you requires correction or updating, for example because the information is inaccurate, out-of-date, incomplete, irrelevant or misleading, you may request that the information be corrected by contacting the Site Manager or Privacy Officer of cohealth at any time.

cohealth will make a decision on your request to access or correct records within 30 days of your request. If we refuse your request for access or correction, we will provide you with reasons for the refusal in writing, and details about how you may complain about the decision.

cohealth will store all feedback separately to a client’s electronic health record. Your feedback will be kept confidential and only those involved in the complaint handling will have access to the details.

cohealth follows the Complaint Handling Standards of the Health Complaints Commissioner, in accordance with the Health Complaints Act 2016 (Vic) and Health Complaints Act 1995 (Tas). These Acts also provide that consumers can make a complaint to the Health Complaints Commissioner about the way a complaint is handled by a health service provider.

If you would like further information about the way cohealth manages the personal information it holds, please contact the Privacy Officer. If you have any concerns, complaints, or you think there has been a breach of privacy, or you wish to access or correct your personal information, then please contact the Privacy Officer who will first deal with you, usually over the phone.

• Email: privacy@cohealth.org.au
• Call: 03 9448 6266
• Postal: 90 Maribyrnong St, Footscray VIC 3011

If you are not satisfied with our response to your privacy enquiry or complaint, we will seek to meet with you to discuss further.

If you are not satisfied with our response, or in any case you do not wish to deal with us directly, you may at any time raise your enquiry or complaint to any of the following:

Office of the Australian Information Commissioner

• Website: https://www.oaic.gov.au/
• Call: 1300 363 992
• Postal: GPO Box 5218, Sydney NSW 2001

Office of the Victorian Information Commissioner

• Website: https://ovic.vic.gov.au/
• Email: enquiries@ovic.vic.gov.au
• Call: 1300 006 842
• Postal: PO Box 24274, Melbourne VIC 3001

Health Complaints Commissioner Victoria

• Website: https://hcc.vic.gov.au/
• Call: 1300 582 113
• Postal: Level 26, 570 Bourke St, Melbourne VIC 3000

Health Complaints Commissioner Tasmania

• Website: https://www.healthcomplaints.tas.gov.au/
• Call: 1800 001 170
• Postal: GPO Box 960, Hobart TAS 7001

We may revise this Privacy Statement from time to time. We will update you on any changes to this Privacy Statement through our website, and we will make the most current version of this Privacy Statement will be available when you receive services from us, or on your request.

For enquiries concerning this policy, you can contact: privacy@cohealth.org.au