Privacy and Management of Patient Data Policy

Purpose
This policy ensures compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), outlining our commitment to protecting the privacy of both patients and clients.

It applies equally to the management of personal and sensitive information of patients and third-party stakeholders, such as referring providers, corporate partners, and collaborators.

Scope
This policy applies to:
All employees, contractors, and associates of ADHD Lifespan Clinic.
All systems and processes involving the collection, use, storage, and disposal of patient information.

Definitions
Personal Information: Any data that can identify an individual, including names, contact details, and demographic information.

Sensitive Information: Health records, mental health assessments, and any information related to the patient’s treatment or care.

Legal and Ethical Obligations
ADHD Lifespan Clinic complies with:

• Privacy Act 1988, the Notifiable Data Breaches (NDB) scheme, and state-based health privacy legislation.
• National and state guidelines for mental health professionals.
• Professional codes of conduct and ethical standards.

Collection of Patient Information
Purpose: Information is collected to provide appropriate mental health care, manage appointments, and facilitate billing.
Consent: Written or digital consent is obtained before collecting personal and sensitive information.
Method: Information is collected via secure online platforms, phone, or in person during intake or follow-up sessions.

Patient Rights
Access: Patients can request access to their records. Requests must be processed within 30 days.
Correction: Patients may request corrections to their records if they believe there are errors. Complaints: Patients can lodge complaints about privacy breaches with the Privacy Officer.

Use and Disclosure
Primary use: Patient data is used for diagnosis, treatment, and billing.
Disclosure: Only shared with third parties (e.g., referring doctors, allied health providers) with patient consent or as required by law.
Information may be disclosed without consent in cases of serious and imminent risk to the patient or others, as required by law.

Storage and Security
Electronic Records: Stored in secure, encrypted systems compliant with healthcare data standards (e.g., Halaxy, Xestro)
Physical Records: Limited to essential documents, scanned immediately and uploaded to the patients file and shredded.
Access Controls: Only authorised personnel can access patient information.
Backup and Recovery: Regular encrypted backups are maintained and tested for disaster recovery.
Data Breach Response: A documented protocol is in place to manage and report data breaches.

Application to Clients
In addition to managing patient data, ADHD Lifespan Clinic applies the same rigorous privacy and data management standards to client information. This includes the collection, use, storage, and disposal of personal and sensitive information related to referring doctors, allied health professionals, corporate partners, and other professional collaborators.

Client information is handled with the same principles outlined in this policy, ensuring secure storage, limited access, and disclosure only with explicit consent or as required by law. Breach management, retention, and disposal protocols applicable to patient data are also applied to client information.

Retention and Disposal
Patient records are retained for the minimum legal requirement (e.g. 7 years for adults, or until a minor turns 2І, depending on jurisdiction).

Secure destruction of records no longer required, using shredding or certified electronic deletion methods.

Training and Responsibilities
Staff are trained on privacy policies during onboarding and through annual updates. Breaches of this policy may result in disciplinary action, up to and including termination.

Monitoring and Review
This policy is reviewed annually or as needed to ensure compliance with legal and operational changes.

This policy reflects the ADHD Lifespan Clinic’s commitment to maintaining the highest standards of privacy and confidentiality in managing patient information.