ACON Health Limited trading as ACON
Client confidentiality has been an underpinning philosophy and foundation of ACON’s work since its inception in 1985. ACON is subject to the Privacy Act 1988 (‘the Privacy Act’) and the Australian Privacy Principles (APPs) contained in the Privacy Act. The APPs set out the way organisations such as ACON can collect, use, disclose and provide access to personal and sensitive information.
ACON is committed to the protection of your privacy. This Privacy Policy describes how we handle your personal and sensitive information and ensures we manage this information consistently with the APPs. The policy also explains how a client can have information changed or altered if it is incorrect or out of date.
This policy applies to the whole of ACON, the Board, staff (including all levels of management), volunteers and contracted service partners.
The Privacy Act 1988 sets out a client’s rights and ACON’s responsibility relating to any personal information held about them. The Act provides clients with the right to know why ACON holds their personal information, what information is held about them, how ACON will use that information and under what circumstances their personal information may be divulged to others.
The Act put in place the APPs which regulate how organisations such as ACON should collect, keep, use and disclose personal information. ACON complies with and, wherever possible, strives to exceed the requirements of the Act. ACON complies with all of APPs.
The thirteen APP’s allow for individuals to exercise rights and choices about how their personal and health information is handled in the private health sector. The Act also gives people these rights over personal information held by other private sector organisations.
In addition, the National Health and Medical Research Council (NHMRC) has issued guidelines (s.95 and s.95A), approved by the Privacy Commissioner. These guidelines balance the protection of an individual’s health information with the need for ethically approved research using individuals’ health data without consent.
Clients have the right to request access to their personal information and for it to be changed or altered if incorrect or out of date. Under special circumstances outlined in AAP 12, ACON may refuse to allow a client to see information held about them, but is required under the Act to explain why. The Act provides that a client may make a complaint to ACON or the Privacy Commissioner if they think their information is not used or held appropriately and in accordance with the Act.
The Office of the Australian Information Commissioner’s website contains detailed information on privacy
obligations.
The Privacy and Personal Information Protection Act 1998 deals with how all New South Wales public sector agencies manage personal information. It also sets out the role of the NSW Information and Privacy Commission.
While the PPIP Act applies primarily to the New South Wale public sector, when private sector organisations contract with NSW government agencies to provide services to them, the terms of the contract will sometimes require the organisation to follow the Information Protection Principles (IPPs) in how it delivers those services.
The Health Records and Information Privacy Act 2002 (HRIP Act) governs the handling of health information in the public sector, and it also regulates the handling of health information in the private sector in New South Wales.
The 15 health privacy principles (HPPs) are the key to the Health Records and Information Privacy Act (HRIP Act). They are legal obligations describing what organisations (NSW public and private sector) must do when they collect, hold, use and disclose health information. These roughly parallel the Federal principles.
Other relevant New South Wales laws include, but are not limited to:
The Act provides that personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable. Personal information includes such things as a person’s full name, date of birth, gender, address and other contact details.
The Act recognises that information of a more sensitive nature may be collected by organisations such as ACON in order to provide clients with or refer them to particular services. Sensitive information is a subset of personal information. It means information or opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, gender identification, criminal record or health information about an individual.
Appendix A provides a short summary that sets out clearly expressed policies on the way ACON manages personal information. It must be made available to anyone who asks for it.
(i) criminal offences; or
(ii) breaches of a law imposing a penalty or sanction; or
Under section 16B of the Privacy Amendment Act, a permitted health situation may provide an exemption to the requirements of AAP6 in relation to the health information of an individual.
A permitted health situation exists if collection of the information is necessary to provide a health service to the individual, and the collection is either required or authorised by or under an Australian law (other than this Act); or the information is collected in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind ACON.
A permitted health situation may also exist in relation to the collection of health information about an individual if the collection is necessary for research relevant to public health or safety; the compilation or analysis of statistics relevant to public health or public safety; or the management, funding or monitoring of ACON as a health service.
However, the collection of personal information in these research-related circumstances are permitted only if the purposes above cannot be served by the collection of information about the individual that is de-identified information and it is impracticable for ACON to obtain the individual’s consent to the collection where:
A permitted health situation may exist in relation to the use or disclosure by an organisation of health information about an individual if:
A permitted health situation may exist in relation to the disclosure by ACON of health information about an individual if the organisation provides a health service to the individual; and the recipient of the information is a responsible person for the individual; and the individual is physically or legally incapable of giving consent to the disclosure; or physically cannot communicate consent to the disclosure; and another individual (the carer) providing the health service for ACON is satisfied that either the disclosure is necessary to provide appropriate care or treatment of the individual; or the disclosure is made for compassionate reasons.
The disclosure cannot be contrary to any wish expressed by the individual before the individual became unable to give or communicate consent; and of which the ACON carer is aware, or of which the ACON carer could reasonably be expected to be aware; and is limited to the extent reasonable and necessary to provide appropriate care or treatment of the individual; or the disclosure is made for compassionate reasons.
ACON’s Privacy Policy and this FAQ Sheet are publicly available through ACON’s website. Copies of this FAQ may also be obtained through the contact details provided at the end of this document.
On request by an individual, ACON will take reasonable steps to let that individual know, generally, what sort of personal information it holds, for what purposes, and how it collects, holds, uses and discloses that information.
ACON has a complaints procedure for anyone who believes their information is not being handled properly or in accordance with this policy. A copy of ACON’s complaints procedure may also be obtained through the contact details at the end of this FAQ.
When individuals engage with us, we may collect and hold some or all of the following personal
information:
If individuals choose not to provide the information ACON request from them, ACON may not be able to
provide them with the services, resources and other tools that they may require.
When collecting personal information, ACON will take reasonable steps to make an individual aware of:
ACON uses fair and lawful ways to collect personal information and only collects personal information that is necessary for our functions or activities. We collect personal information directly from the individual whenever it is reasonable and practicable to do so.
If ACON collects personal information about an individual from someone else, we will take reasonable steps to ensure that the individual is made aware of the matters listed below, except to the extent that making the individual aware of the matters would pose a serious threat to the life, health or safety of any individual or to public health and safety.
ACON always gets consent to collect sensitive information unless specified exemptions apply.
We may collect, hold, use and disclose individuals personal information for the following purposes
Information about an individual will only be used or disclosed to others by ACON in ways which meet that individual’s expectations or are required by law.
ACON will only use or disclose personal information for a purpose other than the primary purpose for which it was collected if:
ACON will only use or disclose personal information without the individual’s consent, when:
ACON may disclose health information about an individual to a person responsible for that individual such as a legally appointed guardian.
Under limited exceptions, ACON may permit the collection, use or disclosure of information for secondary purposes of:
Where we use personal information to send an individual marketing and promotional information by post, email or telephone, ACON will provide them with an opportunity to opt-out of receiving such information. If an individual does not wish to receive direct marketing communications from ACON, they can also contact ACON at, 414 Elizabeth Street, Surry Hills 2010 NSW, Tel: + 61 2 92062000 and email: ac**@******rg.au.
ACON will take all reasonable steps to ensure that personal information collected, used or disclosed about a client is as appropriate, accurate and current as possible.
ACON undertakes to ensure that all personal information is kept in a secure place or manner. We will take all reasonable steps to protect client information from misuse, loss, unauthorised or unnecessary access, interference, alteration or disclosure. ACON undertakes to destroy or de-identify personal information when it is no longer required for any purpose or by law.
Access to an individual’s information is limited to those ACON personnel (staff or volunteers) who require the information for the effective provision of a service to that individual or those specifically authorised at the individual’s request. ACON personnel may not divulge any identifying information about a client to others except where necessary to provide appropriate service to that individual.
ACON will provide individuals with access to their personal information upon request. The individual may arrange an appointment to view their personal information or they may request a written copy. To obtain access to, or copies of, or to correct or up-date their personal information a client will need to complete a ‘Personal Information Inquiry’ form.
Under some circumstances, it may be inappropriate for ACON to provide an individual access to their personal information (e.g., providing access would pose a serious threat to the life or health of any individual; or would have an unreasonable impact upon the privacy of other individuals). ACON will provide reasons for any denial of access or a refusal to correct personal information.
At an individual’s request ACON will correct any out-of-date or inaccurate information. ACON will do this either over the phone or face-to-face. An individual may arrange an appointment to view their personal information or they may request a written copy.
To obtain access to, or copies of, or to correct or up-date personal, sensitive, information a client will need to complete the ‘Personal Information Inquiry’ form. To change just their contact details a client will need to complete the ‘Change of Address’ form. Copies of both of these online forms are available here.
ACON contact details are at the end of this document.
ACON does not use identifiers or reference numbers assigned by other organisations or government departments or services (e.g., tax file number).
ACON does not release its own membership or client case file numbers to other organisations. Nor do we divulge any information that may in any way identify a particular individual to other organisations, or to ACON staff or volunteers.
Wherever practicable and lawful, ACON will provide a client with the option of interacting with ACON anonymously or through use of a pseudonym.
ACON will only send client information to a third-party interstate or in a foreign country with that client’s prior consent or where required by law.
ACON will not collect sensitive information about a client without their consent unless, the collection is necessary to prevent or lessen a serious threat to health or life, or the collection is required by law.
ACON in some instances may collect information without an individual’s consent if the person concerned is physically or legally incapable of giving consent.
ACON may also collect sensitive information without consent in accordance with rules established by competent health or medical bodies that deal with the obligations of professional confidentiality (e.g., client case notes kept about counselling sessions with professionally recognised psychotherapists or session case notes kept by counsellors).
ACON has a Complaints Management Policy. A copy of this policy is available by emailing co********@**on.org.au or telephoning ACON Reception on (02) 9206 2000.
ACON is committed to supporting, and applying the key principles of an effective complaints procedure, and ensures that:
Complaints can be made via telephone, face to face, by email or letter and email it to co********@******rg.au. You can also complete the electronic Complaint Registration Form here.
For any questions about ACON’s Privacy Policy contact our media officer by telephone 02 9206 2000, e-mail on****@******rg.au, fax Attn ACON Media Officer (02) 9206 2069.
ACON Sydney – (02) 9206 2000
Northern Rivers – (02) 6622 1555
Hunter/Mid North Coast – (02) 4962 7700
The Privacy Commissioner’s website contains detailed information on privacy obligations including a copy of the Privacy Act http://www.privacy.gov.au.
Privacy guidelines for health service providers at https://www.oaic.gov.au/privacy/guidance-and-advice/guide-to-health-privacy/ set out the standards for collecting, storing, using and disclosing personal information.