Westside Medical Services
Privacy Policy
Westside Medical Centre
11 Highfields Circuit, Port Macquarie NSW 2444
Tel: (02) 5519 8200 | Fax: (02) 9024 4629
ABN: 28 140 109 182
Reviewed: July 2026
PURPOSE
At Westside Medical Centre, we are committed to protecting the privacy of patients and safeguarding patients’ personal information. This Privacy Policy explains how we collect, use, disclose, and manage patients’ ersonal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
OUTCOMES
– Describing the collection, use and disclosure of personal information
– Clarifying the rights of individual patients to access their personal information
– Outlining security of personal information
– Managing a breach of privacy
– Maintaining currency of Privacy Policy
LEGISLATIVE REQUIREMENTS AND RESOURCES
The Australian Privacy Principles (https://www.oaic.gov.au/privacy/australianprivacy-principles)
The Privacy Act 1988 (https://www.legislation.gov.au/Details/C2022C00199)
RACGP Standards for general practices 5th edition
Accreditation under the National General practice Accreditation Scheme (January 2017)
Australian Health Practitioner Regulation Agency (Ahpra)
Coviu (telehealth consults via website) https://www.coviu.com/en-au/privacy
HotDoc (online appointment bookings and script requests)
https://practices.HotDoc.com.au/privacy-policy/
DESCRIPTION
All patients attending Westside Medical Centre have the right to privacy and the protection of their personal information.
Personal information is any information that can identify one.
COLLECTION OF PERSONAL INFORMATION
We collect personal information that is reasonably necessary for the provision of medical services to patients and for related purposes.
We collect personal information directly from the patient unless it is unreasonable or impractical to do so:
– when the patient completes a patient registration form,
– through your access and use of our website, Facebook page and online booking system (HotDoc),
– disclosure during a consultation.
We may also collect information from third parties:
– provided on behalf of the patient, with the patient’s consent or as required by law.
– from other health service providers,
– from law enforcement agencies and other government entities.
The types of personal information we may collect include:
– Patient’s name, address, contact details (phone number, email address), and date of birth.
– Patient’s gender, ethnic background,
– Medicare number, Veteran Affairs’ number, Healthcare Card number, health fund details and other healthcare identifiers.
– Billing, payment, and health insurance claim numbers
– Any information relevant to the patient’s medical care and treatment, including but not limited to medical history, family history, medications and allergies.
Information that does not identify the patient may also be collected. For example, collecting anonymous feedback, answers to surveys or aggregated information about usage of our website, Facebook page or online booking system (HotDoc).
USE AND DISCLOSURE OF PERSONAL INFORMATION
A patient’s personal information is used and disclosed for the primary purpose of providing healthcare services to the patient. This includes:
– Diagnosis, treatment, and ongoing healthcare management.
– Communication with other healthcare providers involved in patients’ care.
– Billing, payment, and health insurance claims processing.
– Quality assurance activities, including clinical audits and accreditation.
– Research and education purposes provided the patient’s information is de-identified or the patient has given their consent.
– Compliance with legal obligations and regulatory requirements.
STORAGE AND SECURITY OF PERSONAL INFORMATION
We take reasonable steps to protect patient’s personal information from misuse, loss, unauthorized access, modification, or disclosure. Physical, electronic, and procedural safeguards are maintained to ensure the security of information.
Patient files are kept within Best Practice. Our IT systems support privacy through protection measures such as firewalls and antivirus software. Our computers on site and remote access points utilise dual factor uthentication, antivirus and updated software programs. See Remote Access Policy for further information.
However, no data transmission over the internet or storage system can be guaranteed completely secure. Our website is linked to the internet, and the internet is an inherently insecure channel for information exchange. Although we strive to protect such information, we cannot ensure or warrant the security of any information that patients transmit to us, and if they do so, it is at their own risk. Once we receive transmissions, we take reasonable steps to preserve the security of the information in our own systems. Electronic referrals are sent via HealthLink and Medical Objects which are secure systems for communicating with other providers.
Appointment bookings, script and referral requests are managed by HotDoc. HotDoc uses standard industry encryption methods when storing and transferring Personal Information and has implemented monitoring and access controls which regulate who can access information. Your personal information will be stored in secure, encrypted electronic format and it will be stored in Australia. Please refer to their Privacy Policy (https://practices.HotDoc.com.au/privacy-policy/). Our telehealth (video) consultations are provided by Healthdirect which is operated by COVIU, who is HIPAA compliant and use endto-end encryption (E2EE) to ensure that your data is always safe & secure. Please refer to the COVIU privacy policy (https://www.coviu.com/en-au/privacy).
Our website may contain links to other websites operated by third parties. We cannot guarantee nor take responsibility for privacy practices of any third-party links.
We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, as required by law, or as otherwise stated in this Privacy Policy. When your information is no longer required, we will take appropriate measures to destroy or de-identify it.
ACCESS AND CORRECTION OF PERSONAL INFORMATION
Patients have the right to access personal information we hold about them, subject to certain exceptions allowed by law.
Patients may request access to any of their personal information via a written request addressed to their treating doctor or the practice manager. We will provide patients with suitable means of access (e.g. by PIN protected email or by collection at the front desk or through mailing it to patients). We may charge a fee to cover administrative and other reasonable costs when providing personal health records.
There may be instances where we cannot permit patients access to the personal information we hold; however, we will only do so in accordance with our rights and obligations under the Privacy Act 1988.
If patients believe that their personal information is incorrect, inaccurate, or incomplete, they may request to complete a Change of Detail form, available from reception.
DISCLOSURE OF PERSONAL INFORMATION
Upon registering as a patient of Westside Medical Centre patients provide consent for Westside Medical Centre staff, directly involved in their health care to access, and use your personal information when required. However personal information will not be shared or disclosed as described in this Privacy Policy or as permitted under the Privacy Act 1988.
THIRD PARTY DISCLOSURE
We may disclose patents personal information to third parties in the following circumstances:
– With the patient’s consent.
– To other healthcare providers involved in the patient’s care.
– To government bodies, regulatory authorities, or law enforcement agencies as required or authorized by law.
– In the event of a sale, merger, or transfer of our business assets.
We take reasonable steps to ensure that third parties who handle patients’ personal information comply with privacy laws and protect patients’ information in a manner consistent with this Privacy Policy.
OVERSEAS DISCLOSURE
We do not generally disclose personal information to overseas recipients. In some cases, however, we may need to transfer patients’ information to an overseas recipient if it is necessary for the provision of healthcare services or if patients have provided consent.
MONITORING OF ADHERANCE TO THE POLICY
Westside Medical Centre has implemented a quarterly Privacy Audit completed by the Office Manager (quarterly). Results are reported to the Practice Manager who will share the results with the owners and action any issues if required.
Regular education is provided on areas of privacy breach risk to staff – relevant to their areas of responsibility. When required education on computer security (such as email phishing scams etc.) are also provided to staff to keep up to date with the latest technology risks of privacy/data breach.
COMPLAINTS AND CONCERNS
Any concerns about how we handle patients’ personal information or if patients believe that we have breached the Australian Privacy Principles, patients are encouraged to inform us in writing, providing details of the incident, either through email: pm@westsidemedical.com.au or mail:
Practice Manager,
11 Highfields Circuit,
Port Macquarie, NSW, 2444.
The incident will be investigated, and we endeavor to resolve the issue within 30 days.
UPDATES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on our website.