Blog

2.1  The OAIC found that 36 GP Clinics had a privacy policy, but four out of the 40 GP clinics did not have a privacy policy that was capable of assessment against APP 1. Findings in the rest of this report refer to the 36 GP clinics assessed.

2.2  20 of 36 privacy policies covered or explicitly referred to the APPs.

2.3  Using the Flesch-Kincaid Reading Ease test, 28 of 36 policies assessed required an education of above Grade 12 to easily read and understand the policy.

2.4  Only four of the 36 privacy policies contained appropriate contact information for individuals to submit access or correction requests or make complaints to the practice.

2.5  The lack of appropriate contact details also affected whether polices had appropriate access, correction and complaint handling provisions. As a result of this, and due to other issues identified by the assessors:

• only two of the 36 policies appropriately advised patients how to make a complaint about possible breaches of their privacy
• only two of the 36 policies appropriately advised patients how they could request a correction to their personal information
• only one of the 36 privacy polices appropriately advised patients how they could request access to their personal information.

2.6  The OAIC found the policies did not contain some of the content required by APP 1.4. Our findings included:

• 18 of 36 privacy policies stated the kinds of personal information they collected and held in a manner considered to meet the requirements of APP1.4
• 23 of 36 GP clinics stated how they generally collect personal information
• 24 of 36 GP clinics stated how they generally hold personal information
• only seven GP clinics stated how they collected and held personal information in a manner considered to meet the requirements of APP 1.4
• 20 of 36 privacy policies stated the purposes as to why they collected, held, used and disclosed personal information in a manner considered to meet the requirements of APP 1.4
• 25 of 36 privacy policies described the reasonable steps the practice took to protect patients’ personal information
• 6 of 36 privacy policies advised patients how the clinic generally would deal with a privacy complaint they received
• 31 of 36 GP clinics have signed a PCEHR Participation Agreement. Only one of the GP clinics specifically referred to the collection, use or disclosure of personal information by GPs through the use of the My Health Record system
• 33 of 36 GP clinics stated that they held IHIs. 12 privacy policies specifically referred to the collection, use or disclosure of IHIs
• No privacy policy specifically referred to the collection, use or disclosure of personal information using an electronic transfer of prescriptions service, which are systems commonly used by GPs.

2.7  19 of the 36 privacy policies did not make any statement relating to overseas disclosures. The majority of those that did refer to overseas disclosures noted that any such disclosure would only be made with the consent of the patient.

2.8  28 GP clinics had a web presence. Of these, 17 published their privacy policy online.

2.9  GP clinics provided access to privacy policies in different ways:

• 35 of 36 GP clinics provided a hard copy of their privacy policy to patients on request
• 30 of 36 GP clinics displayed information about the privacy policy in their practice
• 20 of 36 GP clinics provided a copy of their privacy policy to all new patients who attend their clinic.