Privacy policies

Create a policy: Patient privacy

• Your practice must have a current and patient-focused privacy policy outlining how health information is managed in your practice.
• Your practice’s privacy policy must be available free of charge and easily accessible to your patients in an appropriate form.
• Privacy policies must reflect your practice’s procedures and address all prescribed requirements.
• A privacy policy must explain:
  • how personal information is collected, used and disclosed within the practice
  • how a patient may access and correct their information
  • how privacy complaints can be made and how the complaint will be dealt with
  • whether information is likely to be disclosed overseas and, if so, where.

Create a policy: External privacy

• Your practice should maintain a transparent privacy policy that is freely available both in print and online. For example, display a printed copy at the practice reception desk or in waiting areas, or publish an electronic copy on the practice website.
• The privacy policy content will vary across practices depending on the processes, structure and the record-keeping system in place.
• This privacy policy will enable your practice to better manage patient enquiries or complaints concerning their health information.
• The RACGP has developed a privacy policy template. It is important to adapt this template to ensure its relevance to your practice. The template is available at www.racgp.org.au/running-a-practice/practice-resources/practice-tools/general-practice-policy-and-procedure-templates 

Create a policy: Internal privacy procedures

It is strongly recommended for your practice to have internal privacy procedures in place and documented.

These procedures should include information about:

• the collection of health information, ensuring it is done in a discreet manner protecting the information from unauthorised access
• obtaining a patient’s consent to the use or disclosure of health information by practice employees (including doctors, locums, registrars and other authorised healthcare service providers)
• obtaining a patient’s consent to the use or disclosure of health information for medical research, quality assurance and improvement (where relevant)
• providing patients with access to their health information
• de-identifying health information
• ensuring health information is appropriately disclosed where authorised
• classifying health information, to ensure disclosure is limited to those who are authorised
• ensuring protection against unauthorised access across each medium the practice uses (eg hard copy and electronic records)
• ensuring protection against data loss
• retention of patient medical records to comply with health record law requirements (refer to the section on Retention and destruction of medical records)
• information about privacy and confidentiality training. All staff handling health information must be aware of and comply with the practice’s internal procedures
• details of who will be responsible for overseeing the implementation and operation of the privacy policy and to be the point of contact for privacy concerns.