Patient Privacy information sheet

Patient Privacy Queensland Health Queensland Health (AKA Department of Health) and the Hospital and Health Services (collectively ‘Queensland Health’) are subject to privacy and confidentiality legislation which sets the standards for how we handle personal and confidential (patient) information. The two primary pieces of legislation are the Information Privacy Act 2009 (Qld) (IP Act) and Part 7 of the Hospital and Health Boards Act 2011 (HHB Act).

In order to manage the pandemic while respecting privacy, Queensland Health should aim to limit the collection, use and disclosure of personal information to what is necessary to prevent and manage COVID-19, and take reasonable steps to keep personal information secure.

In late 2019, the Queensland COVID-19 Vaccine Management Program was established to implement the statewide data and digital solutions for the end-to-end COVID-19 vaccine management process. As of September 2021, almost 200 COVID vaccination clinics had been established across Queensland through a combination of mobile, permanent, and temporary community clinics administering Vaxzevria (AstraZeneca) and Comirnaty (Pfizer) COVID-19 vaccines.

Each clinic faces unique challenges associated with maintaining patient privacy due to layout constraints, clinic design and mandatory clinical requirements associated with vaccine management workflows. However, there are practical ways clinics can maintain patient privacy and comply with legislative requirements.

Practical ways to ensure patient privacy in clinics •

Only collect personal and sensitive information for citizens receiving the vaccination and it should be limited to the minimum information reasonably necessary to achieve the purpose

•

Only collect health information by lawful and fair means, and generally only directly from the patient.

•

When you collect personal information about individuals, notify them or make them aware of the collection (ideally beforehand). Notification should include how and why the information is collected, and who the information may be disclosed to, and how they are able to gain access to the information.

•

Being aware of others being able to hear your conversation. Monitor the tone and volume of your voice and avoid inappropriate discussions.

•

Utilise screens to provide privacy.

•

Reminding citizens to maintain the 1.5-metre distancing rule - this also safeguards citizen privacy when staff are confirming personal and sensitive information in open plan clinics.

•

Citizen records are only accessed by staff that are directly involved in the vaccine administration process or if they need the Citizen information to perform other requirements of their work role.

•

Information that is required to be collected for a specific purpose should generally not be used for other purposes.

•

Maintaining awareness of shoulder surfers in public areas and try to angle your computer screen so that other people cannot see what you are typing.

•

Never store citizen personal and sensitive information on USBs or on unsecure nonQueensland Health devices.

•

Using a unique computer log in protected by a strong password.

•

Never sharing log in details with co-workers.

•

Lock your computer whenever you move away from the device.

•

Using secure destruction bins to dispose of sensitive information.

•

A breach of the duty of confidentiality in section 142 of the HHB Act or provisions in the IP Act may be dealt with as staff disciplinary matters under the Code of Conduct.

•

All Queensland Health staff have an obligation to follow and uphold the principles outlined in the National Code of Conduct for Health Care Workers (Queensland).

For more information •

About health records and privacy Visit https://www.health.qld.gov.au/systemgovernance/records-privacy

•

Citizens can be provided Queensland’s COVID-19 Vaccine Management Program Privacy Notice, available on the Queensland COVID-19 Vaccine Management Solution (QCVMS) training site.

•

The Hospital and Health Services (HHSs) are responsible for ensuring they meet their legislated privacy and confidentiality obligations when handling personal and confidential information. Each HHS has a Privacy and Confidentiality Officer (PCCO) who should be contacted in relation to any questions/concerns in relation to this matter.