Privacy Policy August 2021

PRACTICE TO PUT IN THEIR NAME & LOGO

Privacy Policy Purpose The Privacy Act 2020 and Health Information Privacy Code 2020 refers to the purpose for collection, storage, ongoing use of confidential, sensitive patient information and its use by different health care providers or its authorised release to third parties. When problems arise, they relate to a breach of privacy or the release of patient information to someone other than the patient.

Practice Name is committed to ensuring that staff understand the Privacy Act 2020 and Health Information Privacy Code 2020.

Scope All employees, contractors, volunteers, student doctors, student nurses or other health providers working for or on behalf of (Practice Name)

Procedures Privacy Officer The Privacy Officer for Practice Name is Privacy Officer Name and as per the requirements of the Privacy Act 2020 and Health Information Privacy Code 2020 is responsible for: understanding the Privacy Commission’s guidance in relation to the Privacy Act 2020 and the Health Information Privacy Code 2020 in ensuring resources are available for training completing Privacy 101 and Health 101 offered by the Office of the Privacy Commissioner being familiar with the privacy principles in the Health Information Privacy Code 2020 working to make sure their practice complies with the Privacy Act 2020 and Health Information Privacy Code 2020 dealing with any complaints from patients about possible breaches of privacy the practice has received dealing with requests for access to personal information, or correction of personal information if such requests are received acting as the practice liaison with the Office of the Privacy Commission

Training Training required for all new team members and team members who completed training prior to 1st December 2020 is outlined below: All staff will participate in privacy training to support them to comply with relevant privacy legislation 1|Page

Practice Name Privacy Policy 2021

PRACTICE TO PUT IN THEIR NAME & LOGO A record of training will be maintained in the staff personnel file Indicator 2 RNZCGP Foundation Standards recommends all team members complete Privacy Act 2020 and Health Information Privacy Code 2020 (Health ABC) once Indicator 2 RNZCGP Foundation Standard recommends all Officers to complete Privacy 101 and Health 101 (once) •

Health ABC: This course aims to give you an overview of the Health Information Privacy Code, including the main concepts covered by the Code and how the Code applies in practice. (30 minutes) And either

•

Privacy ABC: This course aims to give you an overview of the Privacy Act, including the main concepts covered by the Act and how the Act is applied in practice. (30 minutes) Or

•

Privacy Act 2020: This module aims to give you an overview of why the Privacy Act was revised, and key changes in the new Act. (30 minutes)

Health Information Privacy Principles Staff are to know, understand and implement the 13 health information privacy rules in the Code as follows: Principle 1: Principle 2: Principle 3: Principle 4: Principle 5: Principle 6: Principle 7: Principle 8: Principle 9: Principle 10: Principle 11: Principle 12: Principle 13:

Purpose of collection of health information – only collect if you really need it Source of health information – collect directly from the people concerned Collection of health information from individual – tell them why you require it Manner of collection of health information – be considerate when collecting Storage and security of health information – take care of information held Access to personal health information – people can view their health information Correction of health information – information can be corrected if wrong Accuracy of health information to be checked before use or disclosure Retention of health information – only retain for as long as is required Limits on use of health information – only to be used for the purpose it was collected Limits on disclosure of health information – only disclose when required Disclosure of health information outside New Zealand Unique identifiers – only assign unique identifiers where permitted

Principles 1-4: The first four principles govern how you can collect personal information. This includes when you can collect it, where you can collect it from, and how you can collect it.

Staff are to ensure privacy for patients is always maintained with consideration to the following: giving of any information over the phone or in person (the patient must have given prior consent) 2|Page

Practice Name Privacy Policy 2021

PRACTICE TO PUT IN THEIR NAME & LOGO protection of information on computer screens (please log-off screen when leaving a workstation) sensitive consultations or examinations which should be conducted in a consultation room rather than a triage cubicle to ensure auditory as well as visual privacy completing a enrolment form with staff encouraging the patient to complete this wherever possible giving of an explanation re the sharing of information with medical staff involved in their care e.g. access to recent blood test results if attending the Emergency Department at a Hospital Principles 5, 6 & 7: Principles five, six, and seven govern how you store personal information. People have a right to access and seek correction to their personal information.

Any requests by a patient to access information held about them will be directed to the Privacy Offer who will proceed as follows: Make contact with the patient requesting access to determine legitimacy of the request; Agree a timeframe within which a decision on providing access to the information will be made (as soon as is practicable and no later than 20 days from the time the request was made); Advise the patients responsible clinician of the request; In consultation with the responsible clinician, establish if there are any grounds for withholding information and taking action if required; Contact the patient and agree when , where and in what format the information will be made available; Provide a copy of the documents; Provide support for the patient while reading the information if required.

Keep all records in a secure area where public access is denied, while maintaining accessibility for staff Keep hard copies of old notes for 10 years. After this time, if there is no further secure storage available, records older than 10 years will need to be culled and destroyed by a document destruction company to maintain the confidentiality of the patient Hard drives from crashed servers will be destroyed to ensure no information is retrievable and patient privacy is maintained. The IT Provider will be utilised to support destruction or clearing of data from any discarded hard drives and servers

Principles 8, 9,10,11,12 & 13: Principles 8 to 13 govern how we use and share personal information. It is our responsibility to ensure information is accurate and is used and shared appropriately.

All requests for disclosure of information to a third party are to be sent to the Privacy Officer who will determine if the request is appropriate, advise the responsible clinician of the request, organise the transfer of information, retain a copy of the request in the original notes, ensure that the transfer is completed within 10 days of the request Before using personal information, check that it’s accurate, up-to-date, complete, relevant, and not misleading 3|Page

Practice Name Privacy Policy 2021

PRACTICE TO PUT IN THEIR NAME & LOGO A unique identifier (such as a licence or passport) can only be used where necessary and staff must take steps to ensure unique identifiers are not misused

Breaches: Breaches of policy (including instances of staff/ employee browsing, i.e., staff inappropriately accessing customer information) can have serious consequences for your ongoing employment or contracting with Practice Name including termination of your employment or contract for services.

Breaches will be dealt with in accordance with Practice Name Disciplinary Policy.

What should I do if there is a privacy breach?

Notify the Privacy Officer. A plan will be put in place to look at the following: Contain Try to get the lost information back.

Disable systems that allowed the breach.

Cancelling or changing computer log-ins / passwords Fix any weaknesses in any physical or electronic security Assess Likelihood privacy breach has caused or may cause serious harm.

Actions taken to reduce the risk of harm Sensitivity of personal information What type of harm the breach may cause for those affected Who has obtained the personal information?

Are there security measures that prevent the information from being accessed?

Notify Use the NotifyUs tool on the Office of the Privacy Commissioner website to perform a selfassessment to decide if the breach is notifiable If a privacy breach has caused serious harm, or is likely to do so, there is a requirement to notify the Office of the Privacy Commissioner, affected individuals, and third parties as appropriate Notification of a privacy breach to affected individuals is not required if it would threaten a person’s safety, their interests or their health, the maintenance of the law by a public sector agency, or the security or defence of New Zealand.

Prevent Practice Name Health has a security plan that includes but is not limited to: Security audits of both physical and technical security Review of policies and procedures Review of employee training practices Review of organizations Practice Name works and shares information with

4|Page

Practice Name Privacy Policy 2021

PRACTICE TO PUT IN THEIR NAME & LOGO

IT Systems: Passwords are to be individualised, used, and changed regularly and are not to contain personal details.

Those responsible for IT security will set levels of access so that staff can only access information applicable to their patient’s or area of activity.

Security audits are performed monthly or six monthly Hard drives or any item of equipment that is changing hands will be formatted and wiped clean if it is to be repurposed. This process is managed and performed by the Practice Name IT Provider Name

Alignment with Unsolicited Electronic Messages Act 2007 On September 5 2007, the Unsolicited Electronic Messages Act 2007 came into force. The Act prohibits the sending of unsolicited commercial electronic messages with a NZ link. It also requires all commercial electronic messages to include information about who authorised the message and to provide a functional unsubscribe facility.

The Unsolicited Electronic Messages Act 2007 Act covers email, fax, instant messaging, and mobile/smart phone text (TXT).

Practice Name aligns with Section 6 (b) (ii) (iv) and (vi) for all electronic messaging to their enrolled and casual patients.

Section 6: Meaning of commercial electronic message; For the purposes of the Act Commercial Electronic Message (b) does not include an electronic message that:(ii) facilitates, completes, or confirms a commercial transaction that the recipient previously agreed to enter into with the person who authorised the sending of the message; or (iv) provides notification of factual information about a subscription, membership, account, loan, or similar relationship involving the ongoing purchase or use by the recipient of goods or services offered by the person who authorised the sending of the message, or the recipient’s ongoing subscription, membership, account, loan, or similar relationship; or (vi) delivers goods or services, including product updates or upgrades, that the recipient is entitled to receive under the terms of a transaction that the recipient has previously entered into with the person who authorised the sending of the message; or When enrolling with Practice Name, all new patients have the right to “opt in” to their willingness to receive electronic messaging. This is recorded in the Practice PMS. The Privacy Act does not specify whether individuals should opt-in or opt-out of receiving emails but from a privacy point of view, Practice Name believes allowing people to opt-in is regarded as best practice.

5|Page

Practice Name Privacy Policy 2021

PRACTICE TO PUT IN THEIR NAME & LOGO All newly enrolling patients are provided with a Privacy Statement that outlines they understand what information is being collected and how this will be used.

Links and References Privacy Act 2020 Health Information Privacy Code 2020 Open Disclosure Policy Code of Rights Policy Information Technology and IT Security and Back Up Policy Office of the Privacy Commission

6|Page

Practice Name Privacy Policy 2021