Privacy Policy
Harding Street Medical Centre is committed to protecting the privacy and confidentiality of patient information.
This policy explains how we collect, use, store and share your personal information when you are a patient of our practice. A full copy of our Privacy Policy is available on request from the Practice Manager.
What information we collect
We collect information needed to provide safe and effective healthcare. This may include your:
- name, date of birth, address and contact details
- Medicare number, Individual Healthcare Identifier and health fund details, where applicable
- cultural background, ethnicity and Aboriginal and Torres Strait Islander status, where provided
- medical history, family history, medications, allergies, test results, referrals and other health information relevant to your care.
What is your patient health record?
Your patient health record is the collection of information Harding Street Medical Centre holds about you to support your healthcare. It may include your personal details, Medicare and healthcare identifiers, medical history, allergies, medications, immunisations, consultation notes, referrals, test results, specialist letters, hospital correspondence, recalls, reminders, billing information and other documents relevant to your care. Your patient health record may include information created at HSMC and information received from other healthcare providers. It may be electronic, scanned into your file or, where required, kept in paper form.
Why we collect your information
We collect and use your information to:
- provide medical care and treatment
- manage appointments, billing and Medicare claims
- communicate with you and other healthcare providers involved in your care
- maintain accurate medical records
- meet legal, professional and accreditation requirements
- support quality improvement activities.
By registering as a patient of this practice, you consent to contractor doctors, registrars and practice staff accessing and using your information for these purposes. If we need to use your information for another purpose, we will seek additional consent where required.
You may request to deal with us anonymously or under a pseudonym where this is lawful and practicable, although this may limit the care we can safely provide.
How we protect your information
Patient information is private and confidential. We take reasonable steps to protect it from misuse, loss, unauthorised access, modification or disclosure.
Patient records are stored securely. Access to electronic systems is restricted to authorised users and protected by appropriate authentication controls. Remote access and clinical software access are managed securely with support from our IT provider, GP Support.
Sharing your information
We may share relevant information with other healthcare providers involved in your care, such as specialists, hospitals, pathology, radiology and allied health providers.
We may also share information where:
- you have consented
- it is required or authorised by law
- it is necessary for Medicare, billing or health insurance purposes
- it is necessary to lessen or prevent a serious threat to health or safety
- it is required for accreditation, quality improvement or practice administration.
Only the information necessary for the purpose will be shared.
We use secure communication methods where possible, including secure messaging and Best Practice PIN/password-protected email.
Your health information will not ordinarily be sent overseas unless you are informed and provide consent, and appropriate privacy protections are in place.
My Health Record and electronic prescribing
Our practice may collect, use and disclose health information for electronic health services, including My Health Record and electronic prescribing, where relevant to your care.
Artificial Intelligence tools
HSMC may use secure technology systems, including approved AI-assisted tools, to support healthcare administration, communication, document processing, clinical documentation, referrals, record management, quality improvement and other practice functions.
These tools may assist with tasks such as sorting and filing documents, preparing clinical notes or referrals, managing recalls and reminders, and supporting authorised staff and doctors consulting at HSMC to provide care.
AI-assisted tools do not replace clinical judgement. Doctors consulting at HSMC remain responsible for the care they provide, and authorised staff remain responsible for administrative actions within their role.
Where patient information is processed by an approved technology provider, this is limited to what is reasonably necessary for the relevant healthcare, administrative or practice purpose.
HSMC does not use public AI tools for patient health information. Identifiable patient information is not used to train general-purpose AI models. AI tools used during a consultation require patient consent before use.
Accessing or correcting your information
You have the right to request access to your personal health information and to ask for corrections if information is inaccurate or incomplete.
Requests should be made to the Practice Manager. We will ask you to confirm your identity before information is released or corrected.
Marketing, website and quality improvement
This practice does not use your personal information for direct marketing without your express consent.
Any personal information you share with us through email, online forms or online appointment systems is handled securely and confidentially. Our website may use analytics and cookies to support website function and improvement.
We may use de-identified information for quality improvement, accreditation and population health activities. You will not be identified from this information.
Third parties
We only share patient information where it is necessary for your healthcare, practice operations, billing, legal obligations, quality improvement, or where you have consented.
We may share relevant information with:
- doctors consulting at HSMC, registrars, nurses and authorised practice staff involved in your care
- other healthcare providers, such as specialists, hospitals, allied health providers, pharmacies, pathology and radiology providers
- Medicare, Services Australia, the Department of Veterans’ Affairs, My Health Record, electronic prescribing services, and relevant immunisation or screening registers
- Clinical, communication, secure messaging, document processing and AI-assisted technology systems used by the practice, including Best Practice and affiliated partners, HotDoc, HealthLink, Medical-Objects, Halo Connect and BetterConsult
- BetterConsult, which is an optional pre-consultation questionnaire program. BetterConsult receives only the information needed to send the questionnaire. Any additional health information is provided by you if you choose to complete the questionnaire and is available only to doctor you booked with.
- IT, data storage, backup, cybersecurity and practice support providers, including GP Support
- accreditation, audit, legal, insurance, medical defence and quality improvement organisations, where required
- third parties where disclosure is required or authorised by law, or necessary to lessen or prevent a serious threat to health or safety.
Only the information necessary for the relevant purpose is shared. Third-party service providers are expected to handle information securely and only for the purpose of providing services to the practice. Patient information is not routinely disclosed overseas unless you are informed and consent, or unless otherwise permitted by law with appropriate privacy protections in place.
Privacy concerns or complaints
If you have questions or concerns about the privacy of your information, please contact the Practice Manager:
We will take privacy concerns seriously and aim to respond promptly.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner or the Victorian Health Complaints Commissioner.
More information
A full copy of Harding Street Medical Centre’s Privacy Policy is available on request from the Practice Manager.